The Transnational Cybercrime Extortion Landscape and the Pandemic: Changes in Ransomware Offender Tactics, Attack Scalability and the Organisation of Offending

Abstract

The sudden disruption of work, recreation and leisure practices caused by the COVID-19 lockdown caught many organisations and their employees unaware, especially during the move towards working from home. This led adaptive cybercriminals to shift their own focus towards home workers as a way into organisational networks. The upshot was a massive acceleration in major cyberattacks upon organisations and a noticeable shift in offender tactics which scale up levels of fear in victims to encourage payment of the ransom. Such tactics include a shift towards naming and shaming victims, the theft of commercially sensitive data and attacks targeting organisations which provide services to other organisations. These developments have also led to changes in the organisation of offenders online. Such attacks negatively impact upon national and international economies as they try to recover from lockdown. Drawing upon an analysis of 4000+ cases of ransomware attacks collected for the EPSRC EMPHASIS & CRITICAL research projects, this paper charts the evolution of ransomware as a modern cybercrime and changes in the organisation of cyber-criminals as well as highlighting some of the implications for transnational policing.

Keywords: Cybercrime, Ransomware, Crime and the Pandemic, Organised Cybercrime, Policing cybercrime

JEL Classification: K19, K20