Ransomware has evolved from opportunistic attacks into a sophisticated financial enterprise sustained by cryptocurrency markets, despite enforcement pressure. Drawing on the analysis of 525 ransomware strains (2013–2025), we identify three eras: Spray-and-Prey (2013–2018; fragmented payment practices), Big Game Hunting (2018–2021; targeting high-value organizations), and Ransom Bazaar (2021–present; financialized, service-oriented extortion). These eras are analytic ideal types that show how ransomware operators evolved their tactics, which have come to feature negotiation and flexible pricing, to adapt to cryptocurrency market conditions in ways that mirror broader financialization dynamics. This paper offers two main contributions: (1) an empirical map of payment evolution and (2) a theory of ransomware as commercial adaptation to cryptocurrency markets.
Gundur et al. (Tue,) studied this question.