Black Hat Europe 2025: Reputation as Currency in the Ransomware Economy
At Black Hat Europe 2025, Max Smeets of Virtual Rotes presented research on the LockBit ransomware-as-a-service (RaaS) group, highlighting the critical role of reputation in cybercrime operations. The presentation revealed that between 2022 and 2024, LockBit utilized 194 affiliates, with significant success rates in negotiations and payments. Smeets argued that reputation is vital for both victims and attackers; victims fear brand damage from publicized payments, while ransomware groups must maintain trust to ensure affiliates and victims engage with them. The article contrasts this view with financial perspectives suggesting payment can be cost-effective for rapid business recovery, despite risks like re-targeting and invalidating decryption keys. Furthermore, law enforcement campaigns, such as the 2024 takedown of LockBit, strategically aim to destroy trust in these groups by exposing their failure to delete exfiltrated data. This erosion of trust disrupts the ransomware business model, potentially driving affiliates to other groups. The analysis underscores that beyond technical network access, the psychological element of trust dictates the success of ransomware extortion schemes.
Wire timeline
Black Hat Europe 2025: Reputation as Currency in the Ransomware Economy
At Black Hat Europe 2025, Max Smeets of Virtual Rotes presented research on the LockBit ransomware-as-a-service (RaaS) group, highlighting the critical role of reputation in cybercrime operations. The presentation revealed that between 2022 and 2024, LockBit utilized 194 affiliates, with significant success rates in negotiations and payments. Smeets argued that reputation is vital for both victims and attackers; victims fear brand damage from publicized payments, while ransomware groups must maintain trust to ensure affiliates and victims engage with them. The article contrasts this view with financial perspectives suggesting payment can be cost-effective for rapid business recovery, despite risks like re-targeting and invalidating decryption keys. Furthermore, law enforcement campaigns, such as the 2024 takedown of LockBit, strategically aim to destroy trust in these groups by exposing their failure to delete exfiltrated data. This erosion of trust disrupts the ransomware business model, potentially driving affiliates to other groups. The analysis underscores that beyond technical network access, the psychological element of trust dictates the success of ransomware extortion schemes.
WeLiveSecurity