Is ransomware really organised crime?

Is ransomware a form of organised crime? At first glance, the question seems almost stupid, the answer self-evident. Ransomware groups like REvil, Clop, and LockBit operate with a high level of structure, mirroring corporate organisations – complete with departments, specialised roles, and multi-step processes. These groups carefully plan each phase of their attacks: gaining access, stealing data, encrypting files, starting negotiations, processing payments, and reinvesting the earnings. In ‘Ransom War: How Cyber Crime Became a Threat to National Security,’ to be published in February 2025, I discuss the inner workings of Conti, the most prominent ransomware group in 2021. Leaks of private conversations between members show that Conti leaders even debated remote versus in-office productivity and implemented a bonus and penalty system to reward and discipline employees. 

But does this mean ransomware groups are ‘organised crime’ in the traditional sense? Not exactly. Nobel Prize-winning economist Thomas Schelling’s seminal work ‘What is the Business of Organized Crime?’ dives into its dynamics. He argues that organised crime is not just crime that is organised; it is crime that establishes control over territories or markets, often through violence or coercion, to monopolise a specific illicit service. Think of the mafia’s control over gambling rings or loan sharking within a defined area. These activities do not just happen to be organised – they are intentionally organised to dominate a certain market, using force if necessary. This territorial monopolising is not something ransomware groups do.

Monopolising illicit behaviour

For Schelling, the essence of organised crime lies in monopolistic control – having an extortionist grip on a specific industry or territory. Organised crime groups are not just organised in their operations; they aim to be the only game in town. Take gambling rings, for example. Organised crime syndicates do not merely provide opportunities for gambling; they often dominate it in their area, preventing rivals from entering the scene. Burglars, by contrast, do not bother with such monopolisation. They focus on their own thefts and do not compete for control of neighbourhoods or seek to push other burglars out. But if a group of burglars did begin policing their area, forcing other burglars to fall in line or leave and making deals with local authorities to secure their operations, they would enter the realm of organised crime.

Schelling notes that monopolisation is only viable for certain illicit activities, where exclusivity can be enforced. Bank robbers or pickpockets, for instance, might occasionally cross paths, but they do not need exclusive control. Two robbers targeting the same bank at the same time may compete briefly, but this is not the norm. Their work does not require them to establish territorial dominance or monopolise ‘clients’.

Global targeting without territory

Ransomware groups do not need to monopolise their target pool either. They have a vast range of potential victims to choose from, and occasional overlap is tolerated. A SophosLabs report illustrates this with the case of a Canadian healthcare provider attacked simultaneously by Conti and another group, Karma. Both gained access through the same Microsoft Exchange server vulnerability. Karma breached the network first, stealing data without encrypting the files, apparently due to moral concerns about encrypting healthcare data. Conti, however, had no such qualms: they stole 10.7 gigabytes of data, encrypted the systems, and left a ransom note.

Such double targeting is not common practice, but it demonstrates how ransomware groups operate in a virtually unlimited market. They do not need to secure exclusive ‘rights’ over targets or territories to thrive. Russia-based ransomware groups, for instance, typically avoid companies based in Russia and allied countries but have no other geographic restrictions. They are free to choose from hundreds of thousands of global organisations, each offering a potential ransom payout.

This open market also allows ransomware groups to coexist. Two major ransomware groups can work from the same city, even the same street or building, without conflict. Leaks like those from Conti, which expose private conversations between members, contain no talk of violence against affiliates or rival groups. The groups operate without the coercive, territorial dominance that characterises traditional organised crime.

Where competition is most fierce

Competition between ransomware groups can arise, however, in the recruitment of talent. Ransomware operators require a basic set of technical skills, and many groups enforce entry barriers by mandating exams or vetting processes for newcomers. While it has become easier in recent years to enter the field, the supply of skilled operators is still limited. Since the 2022 invasion of Ukraine, Russia-based ransomware groups have also become more cautious in recruiting beyond their borders, although Ukrainian talent remains active in some largely Russian-run groups.

Ransomware groups often poach from rivals and employ innovative strategies to attract talent. For example, Conti actively sought recruits from former competitors, like REvil. In a memorable stunt, REvil once deposited about $1 million of Bitcoin in a visible crypto wallet on a hacker forum as part of a recruitment effort, showing that they were a serious player. This prompted a flurry of discussion in the forum, which Conti’s human resources department took advantage of by collecting contacts and spamming the list with job offers.

Yet individual ransomware operators enjoy a degree of freedom and choice not found in traditional criminal enterprises. As Jonathan Lusthaus also notes in the ‘Industry of Anonymity’ and other research, cybercriminals can only enforce compliance through limited measures. Without the physical presence or coercive power to hold affiliates captive, cyber-criminal groups rely on declining future collaboration as a primary deterrent. Though they may resort to virtual threats, they lack the violent control that is so central to organised crime.

More like a Silicon Valley startup than organised crime?

Ransomware groups resemble Silicon Valley startups more than traditional organised crime as defined by Schelling. They compete for talent, innovate rapidly, and expertly adapt to ever changing global circumstances. Unlike traditional organised crime, they have no need to control territories or monopolise markets. Instead, ransomware groups thrive in a digital ‘open market’. The result is a globally dispersed ecosystem that challenges conventional understandings of organised crime.