REAMDE vs BlackHat 2017: Tracking ransomware end-to-end

The first time I came across a detailed explanation around ransomware was in Neal Stephenson's REAMDE novel, where it acts (along with an incredibly detailed MMPORG called T'Rain and its cryptocurrency) as the central anchor of the entire narrative, a book of 1000+ pages - highly recommended.

Then, in more recent years, ransomware has turned into a multi-million dollar business in the real world and finally sprung to mainstream media attention in the WannaCry attack last year, the biggest of its kind thus far. Until the start of the BTC rally in the second half of 2017, the title for "the year of crypto" belonged to this software.

In the novel, after a user's machine had been infected and their entire hard drive encrypted within minutes, the only file left intact was a REAMDE [sic] file with instructions how to get them back... Payments needed not only to be carried out in T'Rain's in-game currency, but also virtually transported to a remote place within the game world, alone a setup for several sub-plots within the story.

In the non-fiction case, most existing ransomware authors so far have relied on Bitcoin payments to obfuscate the flow of money paid by victims in order to revive their encrypted files. Considering the overall crypto market cap and $$$ amounts involved in recent attacks, it only makes sense that by now there's not just academic research interest in blockchain transaction tracing, but also seemingly a potentially lucrative business model. That is, at least until a time when some of the newer and more privacy oriented coins (XMR, ZEC, XVG, DASH etc.) become more easily exchangeable for fiat.

Here's a great, insightful talk about the matter by a research team @ Google, Chainalysis et al