The commercialization of ransomware: from spray-and-prey to big game hunting to the ransom bazaar

Gundur, R. V., Topalli, Volkan, Vakhitova, Zarina, Liu, Harry Kangluo, Levi, Michael ORCID: https://orcid.org/0000-0003-2131-2882, Winter, Charlie and Baxter, Alexandra Louise Anderson 2026. The commercialization of ransomware: from spray-and-prey to big game hunting to the ransom bazaar. Crime and Delinquency 10.1177/00111287261440146

PDF - Published Version Available under License Creative Commons Attribution. Download (460kB)

Abstract

Ransomware has evolved from opportunistic attacks into a sophisticated financial enterprise sustained by cryptocurrency markets, despite enforcement pressure. Drawing on the analysis of 525 ransomware strains (2013–2025), we identify three eras: Spray-and-Prey (2013–2018; fragmented payment practices), Big Game Hunting (2018–2021; targeting high-value organizations), and Ransom Bazaar (2021–present; financialized, service-oriented extortion). These eras are analytic ideal types that show how ransomware operators evolved their tactics, which have come to feature negotiation and flexible pricing, to adapt to cryptocurrency market conditions in ways that mirror broader financialization dynamics. This paper offers two main contributions: (1) an empirical map of payment evolution and (2) a theory of ransomware as commercial adaptation to cryptocurrency markets.

Item Type:	Article
Date Type:	Published Online
Status:	In Press
Schools:	Schools > Social Sciences (Includes Criminology and Education)
Publisher:	SAGE Publications (UK and US)
ISSN:	0011-1287
Date of First Compliant Deposit:	11 May 2026
Last Modified:	11 May 2026 12:30
URI:	https://orca.cardiff.ac.uk/id/eprint/186936

Actions (repository staff only)

Edit Item