The goal of this paper is to help decision-makers and entities who can protect systems from ransomware at scale, such as the security industry, governments, and policymakers, to form defensive strategies on how best to make an impact on the ransomware ecosystem. While this paper does not focus on hands-on technical defenses that an enterprise would look to for deployment, it does aim to provide decision-makers with methods for understanding the level of risk that an organization faces from this threat.

This research paper is a joint effort between Trend Micro and Waratah Analytics, a data-modeling, risk-analysis, and exposure management services provider. It analyzes the modern ransomware ecosystem using data-science approaches and leverages information collected from network-based and host-based telemetry, underground forums, bitcoin and financial transactions, and chat logs - together with a deep analysis of criminal business processes - to find trends, new developments, and choke points in the ransomware ecosystem.