RANSOMWARE AS AN ECONOMIC CRIME: A DECISION-THEORETIC MODEL OF THE EXTORTION TRANSACTION AND AN EVALUATION OF DETERRENCE INSTRUMENTS
Abstract
This article analyses extortion by means of malicious encryption — ransomware — as an economic crime whose persistence is determined not by the cryptographic strength of the attack but by the structure of the incentives facing the victim, the offender and the state. The extortion transaction is formalised as a sequential decision problem in which the victim minimises expected loss over three branches: recovery from backup, payment of the ransom and refusal without recovery. The condition under which payment is rational for an individual victim is derived, and it is shown that this condition is satisfied in a wide region of the parameter space, so that the aggregate persistence of the offence is a predictable consequence of individually rational behaviour rather than of negligence.
References
1. Crypto Crime Report 2026. – New York: Chainalysis Inc., 2026.
2. Internet Crime Report 2025. – Washington: Internet Crime Complaint Center, Federal Bureau of Investigation, 2026.
3. Cost of a Data Breach Report 2026. – Armonk: IBM Security, 2026.
4. Becker G.S. Crime and Punishment: An Economic Approach // Journal of Political Economy. – 1968. – Vol. 76, No. 2. – P. 169–217.
5. Kharraz A., Robertson W., Balzarotti D., Bilge L., Kirda E. Cutting the Gordian Knot: A Look Under the Hood of Ransomware Attacks // Detection of Intrusions and Malware, and Vulnerability Assessment (DIMVA 2015). – Cham: Springer, 2015. – P. 3–24.
6. Huang D.Y., Aliapoulios M.M., Li V.G., Invernizzi L., Bursztein E., McRoberts K., Levin J., Levchenko K., Snoeren A.C., McCoy D. Tracking Ransomware End-to-end // 2018 IEEE Symposium on Security and Privacy (SP). – San Francisco: IEEE, 2018. – P. 618–631.
7. Connolly L.Y., Wall D.S. The rise of crypto-ransomware in a changing cybercrime landscape: Taxonomising countermeasures // Computers & Security. – 2019. – Vol. 87. – 101568.
8. Laszka A., Farhang S., Grossklags J. On the Economics of Ransomware // Decision and Game Theory for Security (GameSec 2017). – Cham: Springer, 2017. – P. 397–417.
9. Cartwright A., Cartwright E., Hernandez-Castro J. To Pay or Not: Game Theoretic Models of Ransomware // Journal of Cybersecurity. – 2019. – Vol. 5, No. 1. – tyz009.
10. Operation Endgame: results of the coordinated international actions of 2024 and 2025. – The Hague: Europol, 2025.
11. Criminal Code of the Republic of Uzbekistan of 22 September 1994, No. 2012-XII (as amended), Articles 165, 243 and Chapter XX¹, Articles 278¹–278⁶. – URL: https://lex.uz/docs/111457
12. On Personal Data: Law of the Republic of Uzbekistan of 2 July 2019, No. ZRU-547 (as amended). – URL: https://lex.uz/ru/docs/4396428
13. On Cybersecurity: Law of the Republic of Uzbekistan of 15 April 2022, No. ZRU-764. – National Database of Legislation of the Republic of Uzbekistan, No. 03/22/764/0330.
14. On Informatisation: Law of the Republic of Uzbekistan of 11 December 2003, No. 560-II (as amended). – URL: https://lex.uz/ru/docs/82956
15. On the Strategy of Development of New Uzbekistan for 2022–2026: Decree of the President of the Republic of Uzbekistan of 28 January 2022, No. UP-60. – URL: https://lex.uz/docs/5841063
16. Convention on Cybercrime, ETS No. 185. – Budapest: Council of Europe, 23 November 2001.
17. United Nations Convention against Cybercrime: adopted by General Assembly resolution 79/243 of 24 December 2024, opened for signature at Hanoi on 25 October 2025. – New York: United Nations, 2025.
18. #StopRansomware Guide. – Washington: Cybersecurity and Infrastructure Security Agency and Federal Bureau of Investigation, 2023. – 46 p.
19. ENISA Threat Landscape 2025. – Athens: European Union Agency for Cybersecurity, 2025.
20. Anderson R., Barton C., Bohme R., Clayton R., Ganan C., Grasso T., Levi M., Moore T., Vasek M. Measuring the Changing Cost of Cybercrime // Proceedings of the 18th Annual Workshop on the Economics of Information Security (WEIS). – Boston, 2019. – 32 p.
21. Meland P.H., Bayoumy Y.F.F., Sindre G. The Ransomware-as-a-Service economy within the darknet // Computers & Security. – 2020. – Vol. 92. – 101762.
22. Oosthoek K., Cable J., Smaragdakis G. A Tale of Two Markets: Investigating the Ransomware Payments Economy // Communications of the ACM. – 2023. – Vol. 66, No. 8. – P. 74–83.
23. Framework for Improving Critical Infrastructure Cybersecurity, Version 2.0. – Gaithersburg: National Institute of Standards and Technology, 2024.
24. Contingency Planning Guide for Federal Information Systems: NIST Special Publication 800-34, Rev. 1. – Gaithersburg: National Institute of Standards and Technology, 2010. – 148 p.
