By Chad Whelan, David Bright, James Martin, Callum Jones and Benoît Dupont

Ransomware is one of the most prolific and economically damaging cybercrime threats of the contemporary era. This exploratory study aims to enhance knowledge about ransomware criminal groups. Our focus is on ransomware criminal groups that targeted organisations in Australia, Canada, New Zealand and the United Kingdom between 2020 and 2022. The paper examines the evolution and activities of ransomware criminal groups. Results reveal the most active ransomware criminal groups, the median range of their careers and the most targeted victim organisations by country and sector type. 

Trends & issues in crime and criminal justice no. 719. Canberra: Australian Institute of Criminology, 2025. 2op.

By Chad Whelan, David Bright, and James Martin

The concept of organised cybercrime has been the subject of much debate over the last decade. Many researchers who have applied scholarly definitions of organised crime to cyber-criminal groups have concluded that such groups are not “organised criminal groups” and do not engage in “organised crime”. This paper adopts a different perspective to argue that certain cyber-criminal groups involved in ransomware can and should be considered organised crime if a more contemporary and flexible framework for conceptualising organised crime is adopted. We make this argument using three primary domains of organised crime first described by von Lampe: criminal activities, offender social structures, and extra-legal governance. We narrow in on the concepts of violence and extra-legal governance in particular as they have been interpreted to hold significant differences for criminal groups operating in physical and digital domains. The paper argues that it is time to move on from criminological debates regarding whether organised cybercrime can exist to focus on the many rich questions that researchers can take from organised crime scholarship and apply to cyber-criminal groups. We put forward a reconceptualisation of organised cybercrime towards this end.

Journal of Criminology, 0(0). https://doi.org/10.1177/26338076231199793, Preprint 2023.