This is precisely the fix proposed by the Trump Administration’s Presidential Memo from a few weeks ago: “Expanding Capabilities to Combat Transnational Cyber-Enabled Crime”. The Memo announces a program that will allow vetted private companies to conduct “surveillance and cyber effects operations” against individuals and groups conducting “cyber-enabled crime”. The target is “transnational criminal organizations” and the “cybe…

Read more

When the arrest, prosecution and sentencing of cybercriminals takes place we get a rare opportunity to examine these seemingly faceless offenders. The recent activities of Scattered Spider have created fear for its victims, the cybersecurity community and, with increased media reporting, the general public as well. The immediate realisation on reviewing the published information on these offenders is that they are young and also nerds (I say this as a proud nerd myself). They were both known to spend…

Read more

The paper is a long and winding read, so here I provide some key highlights and reflections. The authors adopt an exploratory approach, seeking to answer three key research questions:

1. How much interest is the underground cybercrime ecosystem showing in these tools and what effects are they having on cybercrime subcultures?

2. Are these communities adopting these tools, and if so, how?

3. What are the economic effects of GenAI innovations on cybercrime?

In terms of data, the paper draws on CrimeBB, an archive managed by the Cambridge Cybercrime Centre, which provides many millions of posts for research on a range of underground forums. The authors curated a sample of 97,895 relevant threads across these forums, spanning from late 2022 until late 2025. This period captures the point at which ChatGPT was released up to the point that the researchers undertook the analysis. In terms of methods, the paper makes use of a mélange of computational and human components, with intersecting quantitative and qualitative elements.

What are the key conclusions from this paper? The authors find, in line with existing literature on cybercrime and technical innovation, that AI adoption among users of underground forums is far from hype worthy. While there is some evidence for its use, no major disruptions to the cybercriminal ecosystem have been observed. Instead, the authors argue that, prior to the AI flood, cybercrime was already increasingly automated and specialised. Low level actors already had access to off-the-shelf tools and scripts, and AI does not significantly lower the barriers to entry any further. For more elite actors, AI aids software development, but in a more incremental way, by supplanting existing means for checking errors and other basic coding tasks.

A key feature of the article’s set up is to test for both maximal and minimal cases of AI adoption by the cybercriminal community. The maximal case would be the development of “autonomous or semi-autonomous crime-gang-in-a-box infrastructure” leading to a “full-scale industrial transformation of the cybercrime ecosystem”. The minimal case is where AI is taken on by actors in unstructured and ad hoc ways with no significant impact seen in the organisation of cybercrime or its key business models. But by the end of this paper, this distinction is almost forgotten, as the cybercriminal use of AI appears so minimal it may even fall short of the hypothesised minimal case. In fact, in their conclusion, the authors editorialise: “In some ways this all suggests a more mature response from the cybercrime ecosystem than we see in industry (possibly because of the lack of a CEO and venture capital class). Many of the broader economic effects reflect patterns also observed in legitimate content and tech economies – for saturation of overproduced low-quality content in particular”.

Throughout the qualitative analysis, there are a number of points at which cybercriminal actors express very ambivalent attitudes towards this new tool and worry it degrades values within their community along with the central place of skill. One poster opines that “AI for code causes a very fast negative degradation of your skills”. Another champions the importance of human critical thinking and problem solving.

In considering cybercrime and AI adoption, we could take Hughes, Collier and Thomas’ work as support for the maxim evolution not revolution. But we do need to be aware of the limitations of this study, many of which are noted by the authors. The CrimeBB database is constituted of open forums that often attract lower-level offenders. More serious and professional cybercriminals from around the globe, who congregate and communicate in closed channels and even offline, may have a different approach to AI. Additionally, like almost all academic studies, this paper cannot speak to the world of today or the future. It is possible novel AI developments, or the way the cybercriminal community engage with them, may shift going forward and we see a major change. But, for the moment and with the information we have, this research supports a more sober assessment of actual use of AI by cybercriminals, rather than speculating on a range of possible uses.

While it is likely that Canvas was breached over a longer period of time, on May 7 the attackers defaced the login page with a public extortion demand and Instructure disabled the platform in response. ShinyHunters, a shadowy network of (probably) young offenders well-known for similar extortions, claimed responsibility. On May 11, a ransom payment was made in exchange for data return, the destruction of stolen data and a promise to cease extortion attempts against Instructure and its customers. For more details on this episode see here, here and here.

Many likely did not take notice of this attack. Canvas is not a big brand that would attract the same level of media attention as more famous entities, such as Harrods or MGM. It is so niche to the education sector, that even some working in cyber threat intelligence may not have paid much attention to the news. But if you work in the education sector, as I do, the episode was immediately noteworthy as it had a direct impact on day-to-day operations. This speaks to the scale and breadth of modern-day cybercrime: beyond the headlines, many victims remain hidden below the surface.

Read more

This AI debate is found within the cybersecurity discourse as well. A good example is the release this month of Anthropic’s Claude Mythos model. Early reporting on the release speculated on the power of this model and the sophisticated hacking threat it could pose. For instance, the BBC reported that “[f]inance ministers, central bankers and financiers have expressed serious concerns about a powerful new AI model they fear could undermine the security of financial systems”. Due to its supposed power, Mythos was only released to a small number of companies and organisations to test, further enhancing the mystique and concerns around the model. In response to these reports, sceptic experts kicked into gear questioning the capacity and importance of the Mythos release, with claims along the lines that the news was a “nothingburger”.

Read more

Cybercrime is often regarded as a somewhat “nerdy” endeavour where threats are chiefly digital rather than physical. But cybercriminals are not just some intangible threat. They exist in the offline world, with some even knowing each other in person. In these cases, physical violence between them is possible, even if it is not the norm. Perhaps the most famous example comes from Turkey in the mid 2000s when a leading fraudster, operating under the nickname Cha0, kidnapped a hacker called Kier and posted pictures of him online, alongside a note branding him as an informant.

Using more recent police data from the Netherlands, Bekkers and Leukfeldt conduct a rare academic study of cybercriminal violence. They analyse 15 closed investigations of cybercriminal networks, with a focus on fraud cases: “phishing, bank helpdesk fraud, online consumer fraud and/or friend-in-need fraud”. This paper is part of a broader project focussed on money mule linked networks. By directly accessing police files and interviewing investigators, the article follows the approach of the Dutch Organised Crime Monitor, which involves direct support from the authorities. Similar approaches are not always possible in other jurisdictions where academic-police cooperation is less developed.

Bekkers and Leukfeldt identify violence or the threat of violence in 10 out of their 15 cases, finding that there is a range of manifestations of violence within financial cybercrime. In sum:

“This primarily involves relatively minor forms, such as threats made to invoke fear and to ensure cooperation from co-offenders. However, while not all suspects were associated with violent behaviours, a number of core members were demonstrably willing and capable of using physical violence. Some already had a history of violent offences, e.g. armed robbery, and introduce these tools in the online crime sphere; not only for direct financial purposes, but also as a more expressive reaction related to conflict, betrayal and status. This reflects the concept of ‘cafeteria-style offending’: some of the offenders involved in offline financially driven crime commit similar offences online, opportunistically looking for different ways to earn money. Other cybercrime suspects were engaged in violent behaviours without a known criminal history”.

They then apply an existing framework of violence to the case studies. Each of the five categories of this framework find some support:

· Violence as part of the modus operandi (1 case)

· Violence as a way of keeping co-offenders in line (8 cases)

· Violence to hide illegal activities from authorities (5 cases)

· Violence as a way of settling disputes (6 cases)

· Violence as a reaction to betrayal (5 cases)

Despite many of these cases involving violence or the threat of violence, it did not appear to be an important part of each cybercriminal business model. That is, perhaps not unexpectedly, because the frauds take place online and victims are duped and digitally victimised (which is what makes these cases cybercrime). There was only one investigation where violence was connected to the modus operandi: a threat that a motorcycle gang would pay a visit to victims if they did not provide their bank account details. The rest of the instances of violence concerned the internal dynamics of the cybercriminal networks. Of the remaining overlapping categories, keeping co-offenders in line was dominant, appearing in eight cases.

While this paper demonstrates the ways in which violence might be embedded within cybercriminal networks, it does not provide evidence that it is widely used. As the authors note, the sample of investigations is not representative of all cybercrime cases. First, the cases are only Dutch and there may be differences in other jurisdictions. Second, the cases are only those that have been prosecuted and there may be differences between these cases and those of cybercriminals who were never caught.

Finally, the cases are not representative even of Dutch prosecutions. There is no sampling frame (complete list) of all relevant prosecutions to choose from, and the selected investigations are intentionally focussed on fraud and money laundering networks. Given that these kind of offences are less technical and often involve offenders who have connections to forms of conventional crime, it would not be surprising if these offenders are linked to violence in ways that criminal hackers and coders are unlikely to be. Money mules, who have access to the proceeds of cybercrimes, are relatively low-level actors who make for unreliable collaborators that need to be kept in line. In this paper, the offenders doing this “keeping in line” owned firearms and had past histories of violent offences, including robbery and assault. It is far more likely that beatings, shootings, or the threat of beatings and shootings, will emanate from these kinds of “thugs” rather than the “nerds” that may be associated with more technical offences.

The article includes examples of public and graphic death threats made online against Nixon, as well as the sharing of AI generated nudes based on her likeness. In line with the Com’s reputation for nastiness, Zetter also makes mention of potential offline threats, including “bricking” (throwing a brick through a victim’s window)…

Read more

Black Axe has its origins in Nigeria but now operates globally. Europol provides a worrying overview:

“The criminal network is known for its involvement in a wide range of criminal activities, including cyber-enabled fraud, drug trafficking, human trafficking and prostitution, kidnapping, armed robbery and fraudulent spiritual practices. The group’s annual criminal proceeds are estimated to be in the billions of euros, generated through many small-scale operations that collectively have…

Read more

The solution to the puzzle identified above is encapsulated in the paper like this:

“Rather than developing new methods to enhance cooperation, it appears that cybercriminals have leveraged existing mechanisms that have worked in many other aspects of human life. In particular, reputation and enforcement have been widely employed in the governance of cybercrime. Online forums and marketplaces have developed a number of institutions which provide order and considerably scale up trade, along with other forms of cooperation, to much larger networks of cybercriminals. These components blur the boundary between self-governance and private governance. Marketplaces extend the reputation mechanism by employing tools like quantitative rating systems and allowing for qualitative reviews and information to be published on users. Administrators also create and enforce rules to prevent scams and other negative behaviours”.

An intriguing theme across the article’s findings is that there appear to be limits to the success of cybercriminal governance. Despite their best attempts to vet membership, enforce rules or resolve disputes, misbehaviour remains a key challenge for these communities. This is not surprising given we are talking about criminal communities, many of whom specialise in forms of online fraud. But it should also be remembered that the application of the law is far from perfect in more legitimate settings. For instance, many crimes are never reported to the police, and, of those that are, only a fraction are investigated and prosecuted to completion. In short, extra-legal governance is “likely to reduce risks involved in cooperation, but it cannot solve them entirely”.

Some of these broad findings may be familiar to readers of Industry of Anonymity. But one of the key points of interest in this new article is that there are “layers of order within the underground, and cybercriminals may not necessarily choose to operate in the most structured and visibly regulated settings”. This is perhaps a natural extension of the idea of private ordering itself. While all cybercriminal governance is informal by virtue of being unofficial and beyond the state, there remain more and less structured forms of this informal governance. Large marketplaces have clearly stated rules, but small groups may operate on mutual understandings and norms. Yet, as the Darkode analysis shows, even when forums have a relatively strict governance system, a shadow system may still prevail: “Examples of this include administrators allowing new members in, like J.P. Morgan, against the standard rules for introduction, as well as disputes where administrators refuse to take a central arbitrator role and instead leave users to engage in their own conflict resolution, or simply allow the information to serve as a potential warning to the community”. For context, J.P. Morgan was the nickname of an elite Russian-speaking actor, who joined the site and was swiftly promoted without having to follow the normal protocols (much to the chagrin of some existing Darkode members).

To sum up the key takeaway from this article:

“For extra-legal governance, and the example of cybercrime, we can see that some rules are relatively formal, even if they are not derived from the state. But even in this type of setting, individuals may develop their own more informal systems of order to aid cooperation. There are layers of extra-legal governance and informal order. It would be a mistake to assume that modes of governance beyond the state’s authority are monolithic, and that users would have universal preferences which can be met by one system alone”.

Read the original article here.

Despite there being a wealth of choices for this month’s newsletter post, I choose not to highlight any of these major events but, instead, to focus on a story which has captured less interest, yet offers an important opportunity for reflection. On November 2, news broke that two individuals were indicted for carrying out ransomware attacks against US companies using ALPHV/BlackCat ransomware, with a third unindicted and unnamed co-conspirator listed (a copy of the indictment can be found here). While we know that the leaders/authors of these kinds of malware are based in Eastern Europe, what’s interesting about this case is that the two named individuals were based in the US states of Georgia and Texas, while the third, unnamed actor was from Florida. But what’s particularly intriguing about this case is that these three individuals were employees of cybersecurity firms. One worked as an incident response manager for Sygnia Cybersecurity Services and the other two worked for DigitalMint, a company that specialises in ransomware negotiations. All three have been fired.

Read more

This narrative may soon need to change. Earlier this month we saw the arrest of two people “on suspicion of computer misuse and blackmail”, both of whom were 17 years old. These arrests were in connection to a cyberattack on Kido International, a childcare company operating nurseries in London. Data related to over 8,000 children were stolen. As part of their extortion attempt, the ransomware group behind the attack published some of the names, photos and other information from a small number of child victims, and called parents to pre…

Read more

The research is based on multi-year fieldwork carried out by Luo in China, where he conducted over 60 interviews with participants from a range of backgrounds, including law enforcement agents, cybersecurity practitioners and former cybercriminals. These participants came from a range of locations across China, from major cities to rural areas. Most of these interviews were conducted in person.

So, what are the key takeaways from this research? First, much like in other parts of the world, Chinese cybercrime has become highly specialised. The relevance of this to unwitting workers is that some roles within the cybercrime industry, such as participating in online chats or making bank transfers, don’t require specialist criminal (or technical) knowledge. This means almost anyone can play a role within cybercrime. As one of the study participants put it: “As long as they are a person who can communicate in Mandarin or a dialect, they basically meet these criminal groups’ requirements for capability”. The paper also finds that these cybercriminal enterprises also engage in “compartmentation” so that various components of the business are separated, and it might not always be obvious that some functions are connected to an illicit enterprise.

The second finding takes this line of thinking further: “the division of labour obscures the illegality of many business segments within the cybercrime industry, making it difficult for recruits to recognise whether their activities are criminal”. One example provided by the authors is a cyber-fraud operation in Fujian Province, which used fake identities and stories to manipulate people into buying overpriced tea. The police officer who uncovered this scam argued that it was often difficult for those involved to determine their connection to criminality:

“Most people in the technical and promotion departments didn’t know they were involved in cyber fraud; they only knew that the company hired them for promotion and maintenance work. What’s more, the group even appeared to be a legitimate company, with ties to schools, and schools even sent interns to work there”.

Luo also located some of those who had participated unwittingly in cybercriminal enterprises. One former member of a cybercriminal organisation, who was a recent university graduate, described only realising the truth on being arrested:

“In the beginning, everything was good, I thought I was doing an ordinary job, and at the end of the year, I was already thinking about the year-end bonus and the year-end party, until one day, the police broke into our office – I thought they went to the wrong door at first”.

From a Western perspective, often we can be quite suspicious of unwitting participants in crime, and wonder whether they either knew of the truth, or should have known. In the context of China, Luo’s data provides good support for the view that, despite these suspicions, there do appear to be a large number of individuals participating in Chinese cybercrime, who genuinely believe they are involved in legitimate work. This support comes from a range of viewpoints, including law enforcement sources.

With that said, the final takeaway from this study indicates that some individuals may eventually become “witting” cybercriminals. As Luo and Zhao put it:

“Some members, upon realising they are involved in criminal activities, choose to leave quietly, not wanting to implicate their colleagues and friends with whom they have established bonds, and wanting to avoid trouble. Meanwhile, other members gradually change their views on criminal involvement through continuous participation and interaction, transitioning from being ‘victims’ caught up in crime to becoming active participants in the ongoing criminal enterprise”.

This idea is clearly the inspiration for the article’s title. At some point, as individuals learn more about the criminality they are part of, they move from being the “butchered” to the “butcher”. As this evolution takes place, the study suggests that the cybercriminal groups use a combination of social bonding, normalisation and threats to keep these workers inside their illicit enterprises.

In sum, a solution to the puzzle of why cybercriminal networks in China choose to draw on unwitting workers, when these people are neither criminally skilled or trustworthy, is provided by this article. The work is not always highly skilled, specialisation means that more criminal elements can be hidden from workers, and, when they do find out, the process is managed to encourage either their continued involvement or their silence.

Read the original article here.

For those interested in the details of the talk, the slides can be found here, and a media report summarising the talk can be found here. In this post I’m focussing on the story of Yaroslav Vasinskyi, aka Rabotnik, a key figure in the Kaseya attack. His account underpins the DEF CON talk and has been contemporaneously publishe…

Read more

On July 24, an Arizona woman was sentenced to 102 months prison time for supporting an intriguing kind of North Korean scheme. As the US Department of Justice press release explained, Christina Marie Chapman was part of a “fraudulent scheme that assisted North Korean Information Technology (IT) workers posing as U.S. citizens and residents with obtaining remote IT positions at more than 300 U.S. companies. The scheme generated more than $17 million in illicit revenue for Chapman and for the Democratic People’s Republic of Korea”.

Read more

This paper is a qualitative comparison of two (anonymised) historical cybercriminal networks, largely comprised of Nigerian offenders who were resident in the UK. These case studies drew on interviews with key investigators, access to police/legal files, as well as an analysis of relevant open sources. We also conducted a comparative analysis of more recent US investigations of Nigerian cybercriminal networks operating around the world. Our key research questions were: “(1) How have Nigerian cybercriminal networks evolved over time? (2) How do Nigerian cybercriminal networks operate abroad, particularly within a European context?” (p. 2).

Case 1 centred on a particular form of “advance fee fraud” (AFF), where the offenders contacted victims in the US to inform them they had won a prize and needed to contact an “agent” to redeem it. In order to access the “winnings”, an initial fee needed to be paid of around $300. Despite the victims being American, many of the key offenders were based in the UK. Case 2 involved “business email compromise” (BEC), whereby the fraudsters impersonated a figure of authority within an organisation (e.g. CEO/CFO) or a supplier to it, directing the transfer of funds into an account the offenders controlled. In many instances, banks will not cover the losses from these fraudulent transactions, in the same way losses from credit card fraud might be restored. The legal files in this case, describe this scam as “sophisticated, well-organised, technologically-aware” (p. 10). Both cases involved losses of at least hundreds of thousands, if not millions of dollars/pounds.

There are several important findings that have come out of the comparison of these cases. First, Nigerian cybercriminals have advanced to incorporate new business models, such as BEC, in addition to the classic advance fee fraud. Second, “while Nigerian offenders are focussed on fraud, they are increasingly engaging with some of the more technical components of cybercrime” (p. 15). They make use of illicit online markets to obtain malware, tools and data to increase the efficiency of their operations. Third, the offenders in these cases were operating in the UK, suggesting a transnational dimension to cybercrime based on migration and not just the transnationalism of the Internet. Following on from this, while there is a growing literature on Nigerian scammers based within Nigeria, there is little information on how such offenders operate abroad. These cases indicate that offenders had considerable offline interactions and were embedded in social networks, linked to friendships, shared residences, and attendance at restaurants and churches connected to the broader diaspora community. The final key finding on these cybercriminal networks is:

“Despite the innovations described in this paper, in human terms, these structures are stable and consistent. This suggests comparable cybercriminal networks can support different business models, ranging from Advanced Fee Fraud to BEC. While we do not have direct evidence in these cases, it is also possible that groups may have evolved from carrying out AFF into carrying out BEC. There are already suggestions within Case 1 of some members of the network engaging with activities beyond conventional AFF” (p. 15).

This figure captures the similar and relatively egalitarian network structures across the two cases. The spiral line indicates the challenges in making clear links to a “boss” based on the information contained in the legal files and interviews (a challenge that was more pronounced in Case 2).

The US cases we examined provided good support for our core case findings. In particular, most of these additional cases involved Nigerian fraudsters operating abroad, across a range of jurisdictions: US, South Africa, Ghana, Malaysia, Canada, and UAE. These cases also support the view that Nigerian cybercriminals have been carrying out increasingly sophisticated offending, and have been engaging with technical tools and services to enhance their operations.

So what is the key takeaway from this research? Cyber-enabled fraud is no less important, or worthy of attention, than more technical forms of cybercrime. In fact, the case studies in this paper indicate that there is not a hard boundary between these categories. While Nigerian cybercriminals are less technical than some other actors, they are innovative and sophisticated in their own way. If we focus only on malware and hacking, the serious threat presented by these other kinds of groups will be ignored. It should not be. After all, even something as seemingly simple as BEC is having great success against organisations of all sizes.

Read the original article here.

Read more

Read more

The title of this book is derived from its opening example: the major ransomware campaign carried out by the ransomware group Conti against Costa Rican public sector organisations, and the subsequent declaration by the country’s president on May 8th 2022 that they were in a “state of war”. This series of attacks, which significantly impacted tax filing and customs operations, caused major real-world harm well beyond the immediate targets. This kind of damage and disruption is now familiar to us, having witnessed attacks on hospitals, energy providers and other forms of critical infrastructure across many countries. In short, Smeets’ key argument is that these ransomware groups, over time, have evolved into a national security threat.

This book offers a sober, scholarly and non-technical analysis of ransomware. It seeks to move beyond media accounts of the impact of such attacks, as well as practitioner reports on their more technical components, and instead offers a “deeper comprehension of the organisational dynamics behind ransomware”. Ransom War has a clear focus on how these groups function like “legitimate businesses, employing increasingly specialised processes”. In focussing on both the social and economic, Smeets is aligned with a maturing line of research within both broader cybercrime and organised crime research. To operationalise this approach, he develops and applies the MOB framework: “Modus Operandi, Organizational Structure, and Branding and Reputation”. Another intriguing dimension of this book, which is tied to this perspective, is the discussion of the “Ransomware Trust Paradox”. This examines the tension between ransomware actors breaking into a victim’s systems and compromising their data, while also requiring that this victim will then trust them not to release the data and to decrypt their systems, if payment is made.

Although it makes broader contributions, in essence, Ransom War could be considered a detailed case study of a single group: Conti, one of the major ransomware operations of recent years. The key reason for this choice is likely the unparalleled public database of the group’s chatlogs that was leaked in 2022. There have been some preliminary analyses shedding light on the group’s internal dynamics, and a number of academic studies have continued to trickle out with different foci and methods. But, in order to provide a comprehensive analysis of the Conti business model and to come to terms with the huge scale of the dataset, a significant book length treatment is certainly warranted. This is Smeets’ main contribution.

As part of this detailed case study, Smeets offers a range of important takeaways on the Conti operation. First, the study finds that, along with a constellation of collaborators, the group had over a hundred individuals in their core network, with over fifty kept on salary. Other malware operations have been compared to startups, but Conti appears more corporatised than these past examples. And while the group was clearly criminal, it also operated across legal boundaries, including by recruiting some workers through conventional job sites, many of whom, at least at first, may not have understood the true nature of their employer. Although some within Conti may have earned significant sums, perhaps USD$100,000s or more, the majority of “Conti’s workforce is on a base salary that aligns with the standard pay scales in Russia's industry”.

Second, despite adopting such a corporate model, Conti still suffered from a number of failures, including, at times, limited innovation. Smeets identifies that the group might have focussed too much on expanding into new business areas and underinvested in their core offering. He even speculates that, like Silicon Valley entrepreneurs, Stern, the leader of Conti, may have become somewhat bored with the day-to-day ransomware business and sought new challenges.

Finally, the book sheds light on the question of how much a major cybercriminal group might work with/for the state. Despite widespread speculation, based on the data, Smeets argues that Conti operates “autonomously and is not directly controlled by Russian state entities like the FSB”, but the group does “occasional collaborations with the government”.

For all the book’s positives, its policy discussion is one of the least impactful components. Ransom War does cover some key topics, for example debates around legislating against victim payments to extortionists, and offers some more novel suggestions, for instance having a code of ethics and training for journalists to reduce ways the media amplify ransomware branding. But the challenge is a major one, and it is not reasonable to expect one scholar and one book to resolve it. Smeets’ policy discussion reinforces that the book’s real payoff is the detailed socio-economic depiction of a leading ransomware group that it provides. Many can benefit from a better understanding of the historical evolution of this threat. Decision-makers might be interested to know that some ransomware groups assess cyber insurance policy holders as more likely to pay out and are therefore seen as a better target. CTI professionals may find some useful analytical tools for engaging with the social and economic, rather than technical, aspects of these groups. Finally, policymakers can gain a deeper understanding of what can lead to the success, and failure, of these groups and develop their own counter-strategies accordingly.

Find Ransom War and its publisher information here.

But as last month's post was on the Trump administration, I do not want to continue too much of a trend, for fear of missing out on numerous other important stories within the cyber world. The risk is that Trump news trumps all other news. The focus of this month’s post is on this very…

Read more

The subject of this month’s post is a form of futurism: how might the Trump presidency affect cybercrime trends? By engaging in this futurism, I also break another rule of this newsletter, which is to avoid making long term predictions that risk misinterpreting the noise or being contradicted by the truly unexpected. Given that Trump is an unpredictable figure, these risks are heightened even more. But as we are living through an age of norm-breaking, it seems f…

Read more