Double-Extortion Ransomware: A Study of Cybercriminal Profit, Effort, and Risk

In the rapidly evolving world of cybercrime, law enforcement agencies are increasingly challenged to adapt their strategies and tools to effectively combat digital threats. This Ph.D. dissertation investigates the criminal decision-making processes behind ransomware attacks, including the human factors, economic incentives, and risks involved. The dissertation combines empirical analysis of ransomware incidents, the effectiveness of police interventions, and behavioral insights from offenders to offer a deeper understanding of how interventions can influence ransomware attacks.

A key finding of the research is the importance of understanding offenders' economic calculations, including profits, effort, and risk, which are central to Rational Choice Theory. Additionally, the study explores the role of law enforcement interventions, such as sanctions, arrest strategies, and the use of decryptors, in disrupting ransomware activities. By applying data-driven models, including capture-recapture methodology and hurdle model estimation, the dissertation provides a comprehensive approach to estimating the prevalence of ransomware attacks and understanding the effectiveness of law enforcement measures. This research aims to improve the capacity of law enforcement to design more effective, evidence-based strategies to combat ransomware, ultimately contributing to a safer digital environment.