The Ransomware Blueprint: Attack Patterns and Strategic Variations Across Gangs

Ransomware defense often assumes threat groups follow uniform playbooks or pick targets opportunistically. Our research paper, published in the Journal of Information Security and Applications (Vol. 95, December 2025, Article 104264) and forming part of my Ph.D. dissertation in Information Technology for Engineering at the University of Sannio (Pietro Melillo, Ph.D.), tests that assumption empirically across multi-year incident data.

Research Scope and Dataset

The study analyzes more than 16,000 documented ransomware incidents attributed to 155 ransomware gangs between 2020 and 2024, combining leak-site disclosures with MITRE ATT&CK technique mappings.

Key Empirical Findings

• Generalist vs. Specialist Groups: Active groups diverge sharply in how they pick targets. High-volume generalist gangs target diverse sectors and geographies broadly, whereas specialist groups concentrate on narrower victim profiles aligned with higher extortion leverage.
• Divergent MITRE ATT&CK Profiles: Grouping incidents purely under a generic “ransomware” label hides operational differences in initial access, privilege escalation, evasion, and impact techniques across groups.
• Defensive Prioritization: Mapping threat-group specializations against sector and regional exposure enables security teams to weight MITRE ATT&CK controls toward the techniques actually favored by active adversaries in their industry.

Full Publication

• Journal: Journal of Information Security and Applications, Vol. 95, Article 104264 (December 2025)
• ScienceDirect: ScienceDirect Article S2214212625003011
• DOI: 10.1016/j.jisa.2025.104264