Examining the Activities and Careers of Ransomware Criminal Groups

By Chad Whelan, David Bright, James Martin, Callum Jones and Benoît Dupont

Ransomware is one of the most prolific and economically damaging cybercrime threats of the contemporary era. This exploratory study aims to enhance knowledge about ransomware criminal groups. Our focus is on ransomware criminal groups that targeted organisations in Australia, Canada, New Zealand and the United Kingdom between 2020 and 2022. The paper examines the evolution and activities of ransomware criminal groups. Results reveal the most active ransomware criminal groups, the median range of their careers and the most targeted victim organisations by country and sector type. 

Trends & issues in crime and criminal justice no. 719. Canberra: Australian Institute of Criminology, 2025. 2op.