The Commercialization of Ransomware: From Spray-and-Prey to Big Game Hunting to the Ransom Bazaar
Abstract
Ransomware has evolved from opportunistic attacks into a sophisticated financial enterprise sustained by cryptocurrency markets, despite enforcement pressure. Drawing on the analysis of 525 ransomware strains (2013–2025), we identify three eras: Spray-and-Prey (2013–2018; fragmented payment practices), Big Game Hunting (2018–2021; targeting high-value organizations), and Ransom Bazaar (2021–present; financialized, service-oriented extortion). These eras are analytic ideal types that show how ransomware operators evolved their tactics, which have come to feature negotiation and flexible pricing, to adapt to cryptocurrency market conditions in ways that mirror broader financialization dynamics. This paper offers two main contributions: (1) an empirical map of payment evolution and (2) a theory of ransomware as commercial adaptation to cryptocurrency markets.
Fields of Study & Subjects
Advanced Malware Detection Techniques
Cybercrime and Law Enforcement Studies
Cybersecurity and Cyber Warfare Studies
Publication details
- Journal / source
- Crime & Delinquency
- Publisher
- SAGE Publications
- Volume
- 72
- Issue
- 11
- Pages
- 3251–3290
- Publication date
- 28 April 2026
- Language
- EN