What the blockchain tells us about the big business of ransomware

Ransomware attacks follow a set pattern, leaving a trail and providing insights into the economic activity connected with such attacks. Payment is usually demanded in cryptocurrencies, avoiding cross-border complications. Since 2019, attackers have threatened to leak unencrypted files, putting employee, client, and vendor data at risk. The FBI used blockchain analytics to recover payments to Darkside in 2021, and the tool Elliptic has revealed the activity of ransomware group REvil/Sodinokibi since 2019.