Game Theory of Data-selling Ransomware

Abstract

We are experiencing the worst years of ransomware attacks with continuing news reports on high-profile ransomware attacks on organizations such as hospitals, schools, government agencies and private businesses. Recently a few ransomware attackers have gone beyond simply encrypting files and waiting for ransom. They threaten to release the data if the victims refuse their ransom request. In this paper, we propose a hypothetical new revenue model for the ransomware, i.e., selling the stolen data rather than publishing the data for free. Through a game-theoretical analysis between attackers and victims, we contribute a novel model to understand the critical decision variables for the proposed data-selling ransomware (which we refer as "ransomware 2.0") that sells data as well as demands ransom. We compare the role of reputation and the profitability of the data-selling ransomware with traditional ransomware ("ransomware 1.0") that demands ransom only and the data-threat ransomware ("ransomware 1.5") that demands ransom with the threat of releasing data for no compliance. Both theoretical modeling and simulation studies suggest that in general both ransomware 2.0 and 1.5 are more profitable than ransomware 1.0, while ransomware 2.0 is always more profitable than ransomware 1.5. Notably, common defensive measures that may work to eliminate the financial incentives of ransomware 1.0 may not work on ransomware 2.0, in particular the data backup practice and the never-pay-ransom strategy. Our findings also suggest that the uncertainties created by this new revenue model may affect attackers' reputation and users' willingness-to-pay, therefore, ransomware 2.0 may not always increase the profitability of attackers. Another finding of the study suggests that reputation maximization is critical in ransomware 1.0 and 1.5, but not in ransomware 2.0, where attackers could manipulate reputation for profit maximization.

Mitigating Data Exfiltration Ransomware through Advanced Decoy File Strategies

“…Recent research has further explored the financial motivations and economic factors driving ransomware innovation [42]. Threat actors continuously refine tactics and tools to maximize profits, targeting victims based on perceived willingness-to-pay [3,43]. Groups are also professionalizing, with some even providing "customer service" to aid ransom payment and data recovery [31,1].…”

Untitled

“…Not only is phishing used to facilitate the installation of ransomware, also ransomware is increasingly used to indirectly steal credentials, which sometimes lead to more phishing [50,51]. Another way ransomware leads to phishing is in which the content of the phishing email seems more credible by addressing a recent or on going ransomware attack.…”

“…A third way for ransomware to possibly lead to phishing was described by [50]. [50] studied different factors contributing to maximizing profit of a ransomware attack.…”

“…A third way for ransomware to possibly lead to phishing was described by [50]. [50] studied different factors contributing to maximizing profit of a ransomware attack. Their conclusion was that combining ransomware with data-stealing is in general more profitable than ransomware without stealing the data, and that selling the stolen data is always more profitable than threatening to leak the data.…”

Dynamics of Targeted Ransomware Negotiation

“…Very recently, ideas from game theory have been found to be useful in the study of ransomware. While all ransomware follows the same fundamental principles, there is sufficient variety in observed phenomena to merit a variety of models, such as defence and deterrence [17]- [21], iterative negotiations [22], price discrimination [23], incentive to return encrypted data data [24], and sale of stolen data [25]. In this paper, we examine how game theory can be applied to the growing threat of targeted ransomware.…”