Analyzing Concentration, Temporal Routines and Targeting in Public Ransomware Leak Site Data

• URL: http://arxiv.org/abs/2605.24559v1
• Date: Sat, 23 May 2026 12:50:53 GMT
• Title: Analyzing Concentration, Temporal Routines and Targeting in Public Ransomware Leak Site Data
• Abstract summary: To increase pressure on victims, most groups host so-called data leak sites, where information about their victims is made public.<n>Using leak site posts as behavioral traces of ransomware groups, we created a dataset consisting of over 27,000 posts from 325 groups.<n>Our findings suggest that groups do not behave entirely random. Instead, the observable traces found on leak sites show concentration of activity, temporal routines and selective patterns.
• Score: 4.770429867462457
• License: http://creativecommons.org/licenses/by-nc-nd/4.0/
• Abstract: Ransomware has grown to become one of the most damaging types of cybercrime, affecting private and public organizations in any sector. While early types of ransomware targeted many victims via automated attacks, ransomware groups have started to specifically target organizations and companies in the expectation of receiving larger ransoms. To increase the pressure on victims, most groups host so-called data leak sites, where information about their victims is made public. The shift towards 'human-operated' ransomware together with easily accessible behavioral traces available from data leak sites makes research investigating operational regularities of ransomware groups of interest. Using leak site posts as behavioral traces of ransomware groups, we created a dataset consisting of over 27,000 posts from 325 groups. Based on this dataset, we analyzed victim concentration, temporal routines and targeting regularities. Our findings suggest that groups do not behave entirely random. Instead, the observable traces found on leak sites show concentration of activity, temporal routines and selective patterns.

Related papers

• Enhanced Cyber Threat Intelligence by Network Forensic Analysis for Ransomware as a Service(RaaS) Malwares [0.0]
  Signature based intrusion detection is still on role suffering from the scarcity of RaaS packet signatures.<n>We have analysed RaaS samples by network forensic approach to investigate on packet captures of benign and malicious network traffic.<n>More than 40% of packets are found malicious in this experiment.
  arXiv  Detail & Related papers  (2026-01-20T11:40:58Z)
• Investigating Vulnerabilities of GPS Trip Data to Trajectory-User Linking Attacks [49.1574468325115]
  We propose a novel attack to reconstruct user identifiers in GPS trip datasets consisting of single trips.<n>We show that the risk of re-identification is significant even when personal identifiers have been removed.<n>Further investigations indicate that users who frequently visit locations that are only visited by a small number of others tend to be more vulnerable to re-identification.
  arXiv  Detail & Related papers  (2025-02-12T08:54:49Z)
• Assessing and Prioritizing Ransomware Risk Based on Historical Victim Data [0.0]
  We present an approach to identifying which ransomware adversaries are most likely to target specific entities.<n>Ransomware poses a formidable cybersecurity threat characterized by profit-driven motives, a complex underlying economy supporting criminal syndicates, and the overt nature of its attacks.
  arXiv  Detail & Related papers  (2025-02-06T15:57:56Z)
• Ransomware IR Model: Proactive Threat Intelligence-Based Incident Response Strategy [0.0]
  There is no clear and proven published incident response strategy to satisfy different business priorities and objectives under ransomware attack in detail.<n>In this paper, we quote one of our representative front-line ransomware incident response experiences for Company X.
  arXiv  Detail & Related papers  (2025-02-03T10:25:26Z)
• Showing the Receipts: Understanding the Modern Ransomware Ecosystem [4.058903075267789]
  We present novel techniques to identify ransomware payments with low false positives. We publish the largest public dataset of over $900 million in ransomware payments. We then leverage this expanded dataset to present an analysis focused on understanding the activities of ransomware groups over time.
  arXiv  Detail & Related papers  (2024-08-27T21:51:52Z)
• Understanding crypter-as-a-service in a popular underground marketplace [51.328567400947435]
  Crypters are pieces of software whose main goal is to transform a target binary so it can avoid detection from Anti Viruses (AVs) applications. The crypter-as-a-service model has gained popularity, in response to the increased sophistication of detection mechanisms. This paper provides the first study on an online underground market dedicated to crypter-as-a-service.
  arXiv  Detail & Related papers  (2024-05-20T08:35:39Z)
• Ransomware Detection and Classification using Machine Learning [7.573297026523597]
  This study uses the XGBoost and Random Forest (RF) algorithms to detect and classify ransomware attacks. The models are evaluated on a dataset of ransomware attacks and demonstrate their effectiveness in accurately detecting and classifying ransomware.
  arXiv  Detail & Related papers  (2023-11-05T18:16:53Z)
• DISARM: Detecting the Victims Targeted by Harmful Memes [49.12165815990115]
  DISARM is a framework that uses named entity recognition and person identification to detect harmful memes. We show that DISARM significantly outperforms ten unimodal and multimodal systems. It can reduce the relative error rate for harmful target identification by up to 9 points absolute over several strong multimodal rivals.
  arXiv  Detail & Related papers  (2022-05-11T19:14:26Z)
• Causal Scene BERT: Improving object detection by searching for challenging groups of data [125.40669814080047]
  Computer vision applications rely on learning-based perception modules parameterized with neural networks for tasks like object detection. These modules frequently have low expected error overall but high error on atypical groups of data due to biases inherent in the training process. Our main contribution is a pseudo-automatic method to discover such groups in foresight by performing causal interventions on simulated scenes.
  arXiv  Detail & Related papers  (2022-02-08T05:14:16Z)
• Being Single Has Benefits. Instance Poisoning to Deceive Malware Classifiers [47.828297621738265]
  We show how an attacker can launch a sophisticated and efficient poisoning attack targeting the dataset used to train a malware classifier. As opposed to other poisoning attacks in the malware detection domain, our attack does not focus on malware families but rather on specific malware instances that contain an implanted trigger. We propose a comprehensive detection approach that could serve as a future sophisticated defense against this newly discovered severe threat.
  arXiv  Detail & Related papers  (2020-10-30T15:27:44Z)
• Give more data, awareness and control to individual citizens, and they will help COVID-19 containment [74.10257867142049]
  Contact-tracing apps are being proposed for large scale adoption by many countries. A centralized approach raises concerns about citizens' privacy and needlessly strong digital surveillance. We advocate a decentralized approach, where both contact and location data are collected exclusively in individual citizens' "personal data stores"
  arXiv  Detail & Related papers  (2020-04-10T20:30:37Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.