Jack Cable of Krebs Stamos Group launches Ransomwhere, a crowdsourced ransomware payment tracker; the site is already tracking $32M+ in ransom payments for 2021
Ransomware attacks, fueled by COVID-19 pandemic turbulence, have become a major money earner for cybercriminals, with the number of attacks rising in 2020. Source: Ransomwhere and Ransomwhere .
The tracker also creates a more granular complement to reports that put 2020 ransomware proceeds at at least $350M. Later coverage shows why such measurement matters: payments reached a record $1.1B in 2023 before falling as more victims declined to pay.
First-order effects
Ransomwhere gives researchers, incident responders, and affected organizations a public, continuously updated reference point for reported 2021 ransom payments.
Jack Cable and Krebs Stamos Group become stewards of a crowdsourced dataset whose usefulness depends on contributors supplying payment evidence and details.
Second-order effects
Public payment tracking makes it easier to compare individual campaigns and payment demands against observed outcomes, sharpening the evidence available to defenders and ransomware researchers.
The tracker adds an independent data source alongside vendor and blockchain-analysis estimates, exposing differences in coverage and methodology rather than leaving a single measurement source to define the market.
Third-order effects
If crowdsourced payment records gain sustained participation, ransomware economics will be assessed through more frequent, transparent indicators rather than retrospective aggregate reports.
The broader pattern is a shift from measuring ransomware only as an attack volume problem toward tracking the payment flows that sustain attacker operations and victims' willingness to pay.
The trend: Ransomware intelligence is moving toward payment-level transparency as researchers seek to measure the economics behind attacks, not just their frequency.
Today, I'm excited to launch Ransomwhere, the open, crowdsourced ransomware payment tracker. Check out the site and contribute data at https://ransomwhe.re/ and follow @ransomwhere_ for updates. Thread on where I see this going:
We had a short interview with @jackhcable about Ransomwhere, his new project that aims to create a database of past ransomware payments https://therecord.media/... https://twitter.com/...
Nobody — not the FBI, not insurers or any standalone threat intel shop — seems to have a clear sense of the larger ransomware picture. This @jackhcable project looks like an awesome way to try remediating that. https://twitter.com/...
If you're interested in more useful ransomware puns, check out Ransomwhere, the open, crowdsourced ransomware payment tracker I launched today. https://twitter.com/...
This is an interesting idea - follow the money being paid for ransomware. Maybe it'll raise awareness, or possibly even help catch a few of culprits. https://twitter.com/...
A new website is created crowdfunded, free, open database of past ransomware payments expanding visibility into the broader picture of the ransomware ecosystem. personal project of Jack Cable, a Stanford University student and Krebs Stamos Group. https://ransomwhe.re/ #CTI https:…
No one really knows how much money has been spent on ransomware payments in the age of cryptocurrency. But @jackhcable's new crowdsourced project could really help fill in the gaps by tracking activity on bitcoin wallets. He's already counted nearly $57M. https://twitter.com/...
This is a fantastic effort! While helping with the RTF and researching for our report, it was shocking how little comprehensive data there was on payments. Glad to see the initiative and very interested to see what comes out of it https://twitter.com/...
President Biden says he told Putin in a phone call that the U.S. will “expect” the Kremlin “to act on” ransomware attacks coming from Russia, even if they aren't sponsored by the government. Reporter: Will there be consequences? Biden: “Yes.”