Ransom Mafia – Analysis of the World’s First Ransomware Cartel

In February 2021, a multinational law enforcement task-force arrested several Ukrainian men for supporting a long-standing ransomware gang known as Twisted Spider1. First seen in May 2019, the gang was behind high-dollar enterprise ransomware attacks. Unfortunately, the arrests in February had little impact; Twisted Spider continued their operations several weeks later in March 2021. Twisted Spider often makes headlines, but it’s not only due to their attacks. In June 2020, the gang put out a press release, claiming they joined forces with several other well-known ransomware attackers to create a criminal cartel. If true, this collaborative partnership would pose a far greater threat to the community than attacks from smaller individual gangs by themselves.