Informal allies: State–cybercriminal alignment in the ransomware ecosystem

Cybercrime frequently crosses national borders, as perpetrators and victims are often located in different countries. This paper asks: what role do states play in shaping cybercriminal activity? Drawing on an original dataset of 4194 double extortion ransomware victims collected from dark web sources, I identify cybercriminal activity aligned with Russian state interests. I find Russia-based groups increased attacks before Western elections, and companies that withdrew from Russia after the invasion—an action widely perceived as a condemnation of Russia—faced an increased risk of attack. I also analysed over 60 000 leaked messages from a major cybercriminal group, which reveals information sharing and cooperation with the Kremlin. Based on these analyses, I argue that the Kremlin maintains an informal cooperative relationship with ransomware groups operating from its territory, advancing a more nuanced theoretical understanding of how states can leverage cybercriminals for geopolitical ends.