The Crook Who Keeps His Word: Why Ransomware Depends on Reputation

There is an almost philosophical absurdity at the center of the ransomware business.

A stranger has broken into your network.

He has stolen your files, disabled your systems, threatened your employees, perhaps interfered with your ability to manufacture products or care for patients, and has now opened a chat window to say:

You can trust me.

More specifically:

Pay me several million dollars and I promise to help you.

It sounds ridiculous.

Yet for ransomware to function as a sustainable criminal enterprise rather than a one-time smash-and-grab, that promise has to mean something.

The ransomware operator does not need to be honest in any conventional moral sense. He does, however, need prospective victims to believe that he is predictably dishonest.

He will break into your network.

He will steal your information.

He will extort you.

But if you satisfy the terms of the extortion, he is expected to honor his side of the criminal bargain.

That expectation is enormously important.

Economists Anna Cartwright and Edward Cartwright put the problem directly in their 2019 paper Ransomware and Reputation: a criminal's ability to profit from ransomware depends critically on victims believing that payment will actually be honored. Their game-theoretic analysis found circumstances in which it is economically rational for the criminal to reliably return access to files because doing so establishes a reputation that makes future victims more willing to pay.

Think about that for a moment.

One of the world's most destructive forms of organized crime contains a primitive version of a consumer-confidence problem.

Ransomware has Yelp reviews.

Not literally, of course.

But close enough.

The strangest contract in capitalism

Traditional ransomware presented victims with a relatively simple transaction.

Your files were encrypted.

The criminal possessed the decryption key.

You possessed money.

The proposition was:

Give us the money and we will give you the key.

There was no court that could enforce this contract. No Better Business Bureau. No escrow agent you could sue. No warranty department.

The person promising to perform the contract had already demonstrated his attitude toward commercial law by illegally taking control of your computers.

Nevertheless, the attacker faced an economic problem.

Suppose every ransomware gang took the ransom and then disappeared without decrypting anything.

Victims would learn.

Incident-response companies would learn.

Insurance companies would learn.

Law enforcement would learn.

Security researchers would learn.

Negotiators would learn.

Pretty soon the rational response to every ransom demand would become:

“Don't bother. These people never provide the key anyway.”

The entire business model would begin collapsing.

It therefore became advantageous for professional ransomware groups to acquire a reputation for doing something that sounds bizarre when applied to an extortionist:

providing the product after receiving payment.

The product happened to be the victim's own data.

But customer satisfaction still mattered.

This phenomenon is not unique to ransomware. Research into cybercriminal markets has repeatedly found that reputation, performance and enforcement mechanisms help strangers conduct illegal business with one another despite having no lawful means of resolving disputes. Jonathan Lusthaus' research into cybercriminal cooperation identified reputation as one of the mechanisms allowing criminals who may know each other only through pseudonyms to transact with some confidence.

There is honor among thieves.

Not because thieves are honorable.

Because stealing efficiently sometimes requires it.

“Can you decrypt these three files?”

Old-fashioned encryption ransomware had another useful characteristic from the extortionist's perspective:

The criminal could demonstrate the product.

Before handing over millions of dollars, a victim could sometimes provide several encrypted files and demand that the attacker decrypt them as proof that the purported decryptor actually worked.

That does not prove that the tool will restore ten thousand servers without problems.

It does not prove that every file survived correctly.

And it certainly does not transform the criminal into a trustworthy service provider.

But it proves something important:

The attacker possesses a functioning key.

The ransom negotiation therefore contains at least one potentially verifiable element.

This helps explain why sophisticated ransomware organizations developed surprisingly elaborate victim-facing infrastructure. Ransomware-as-a-Service operations have supplied communication portals, unique encryption keys, leak sites and negotiation systems to affiliates. Research into the leaked Conti communications even identified “Customer Service/Problem Solving” as one of five major categories of internal discussion.

Imagine being the customer-service representative for ransomware.

“Thank you for contacting Conti support. My name is Boris. I understand you're experiencing difficulty recovering your database after paying us $2.7 million. Before we begin, may I have your victim ID?”

It is grotesque.

It is also economically logical.

If victims routinely pay and discover that the decryptor is garbage, word spreads.

If the decryptor works, negotiators remember that too.

The criminal organization's reputation becomes an asset.

Reputation matters even when you will never meet again

At first glance there is an obvious problem with this idea.

Why should an extortionist care about his reputation with you?

After all, he may never extort you again.

Economists call this the problem of a one-shot interaction. If two parties know they will never transact again, the temptation to cheat can become much stronger because today's behavior cannot directly influence tomorrow's transaction with the same customer.

But ransomware victims don't exist in isolation.

The ransomware operator may never negotiate with Company A again.

He absolutely intends to negotiate with Companies B, C, D and E.

Those companies employ incident responders.

Those responders have dealt with the gang before.

Professional negotiators maintain intelligence about threat actors.

Security firms analyze decryptors.

Law-enforcement agencies study the organizations.

Victims sometimes talk.

The result is something resembling an indirect repeated game.

The criminal is not merely negotiating with the frightened executive sitting across the virtual table today.

He is negotiating with tomorrow's executive too.

His behavior becomes part of the information environment in which future ransom decisions are made.

That makes reputation economically valuable.

And that leads to one of the most bizarre concepts in cybercrime:

brand management.

Welcome to LockBit Incorporated

Ransomware-as-a-Service transformed this problem dramatically.

A modern RaaS operation may separate the people who develop ransomware from the people who actually break into victim networks.

The core operators maintain malware, infrastructure, payment systems and extortion services.

Affiliates find victims, penetrate networks and deploy the ransomware.

The resulting ransom is divided.

When law enforcement disrupted LockBit in 2024, Europol described precisely this structure. LockBit's operators supplied the ransomware infrastructure while affiliates performed attacks, and ransom proceeds were divided between them. U.S. prosecutors have described LockBit affiliates receiving roughly 80 percent while developer Dmitry Khoroshev allegedly received a 20 percent share.

Now reputation has two audiences.

The ransomware organization needs victims to believe:

If we pay, they will deliver what they promised.

But it also needs affiliates to believe:

If I bring them a successful attack, they will give me my share.

This makes a successful ransomware organization resemble an extraordinarily unpleasant franchise.

The core organization supplies the brand.

The affiliate supplies much of the local labor.

Everybody wants confidence that headquarters will honor the revenue-sharing agreement.

If headquarters routinely steals affiliates' money, good affiliates leave.

If affiliates behave so recklessly that every attack produces enormous law-enforcement pressure, the brand suffers.

If the decryptor doesn't work, victims stop trusting the brand.

If negotiations are chaotic, collections suffer.

If the payment infrastructure fails, nobody gets rich.

An organization consisting entirely of criminals still requires organizational trust.

The British National Cyber Security Centre and National Crime Agency have described RaaS groups as competing for affiliates and noted that law-enforcement action can reduce the popularity of a criminal service, causing affiliates to move to other brands. They also observed that many RaaS groups impose purported “terms of service” restricting certain targets, though enforcement varies considerably.

Think of that phrase:

Ransomware terms of service.

Somewhere, apparently, there is a cybercriminal equivalent of clicking:

“I have read and agree.”

We have standards around here

Ransomware gangs have periodically announced restrictions against attacking hospitals, schools, governments or particular countries.

It is tempting to interpret such statements as evidence that the criminals possess some remaining moral boundary.

That would be generous.

There are more practical explanations.

Attacking certain victims produces enormous publicity.

Publicity produces political pressure.

Political pressure produces international investigations.

Investigations produce seized servers, frozen cryptocurrency and indictments.

The NCSC and NCA explicitly describe RaaS “terms of service” as reflecting a risk-driven approach to law-enforcement attention rather than necessarily ethical restraint.

The gang is protecting the brand.

“Please don't attack hospitals” may sometimes mean considerably less:

“Please stop doing things that make the FBI extremely interested in our infrastructure.”

This is corporate governance with a ski mask.

Then ransomware discovered stealing

And here is where the reputation model begins getting much more interesting.

Companies got better at backups.

Not universally.

Not perfectly.

But sufficiently that criminals faced an obvious strategic problem.

If I encrypt your production systems but you can restore them reasonably quickly from isolated backups, my leverage has declined dramatically.

So ransomware evolved.

Attackers began stealing data before encrypting systems.

Now the proposition became:

Pay us and we will give you the decryption key.

And we will refrain from publishing the information we stole.

This became known as double extortion.

Research based on hundreds of Dutch police ransomware reports found data exfiltration to be an important part of the extortion process because it creates pressure even when organizations possess backups.

This was extremely clever.

It also introduced a potentially fatal weakness into the criminal contract.

Decryption and deletion are not the same promise

Suppose a ransomware gang tells you:

“We can decrypt your files.”

You reply:

“Prove it.”

They decrypt three sample files.

The proposition has now gained at least some evidentiary support.

Now suppose the gang tells you:

“We stole 900 gigabytes of confidential information, but if you pay us, we will permanently delete every copy.”

You reply:

“Prove it.”

And here the conversation encounters a fundamental technical problem.

They can't.

They can show you a progress bar saying DELETE.

They can send a screenshot of an empty directory.

They can provide a video of somebody typing rm.

They can swear on the honor of their ransomware organization.

None of those things proves that another copy does not exist.

A second copy might be on another server.

A backup might exist.

An affiliate might have retained one.

The operator might have duplicated it.

A collaborator might possess it.

It might already have been transferred to somebody else.

The data may have been packaged for future sale.

There is no cryptographic equivalent of looking inside every storage device controlled by a criminal organization and confirming:

Yes. The information has ceased to exist everywhere.

That means double extortion changed the nature of the ransomware transaction.

With encryption, the criminal is selling a key.

With data extortion, he is selling a promise of future restraint.

Those are radically different products.

“Trust us. We deleted it.”

Researchers studying double-extortion economics have identified exactly this credibility problem.

Tom Meurs, Edward Cartwright, Anna Cartwright, Marianne Junger and Abhishta Abhishta modeled the interaction as a signaling game involving asymmetric information. Victims often cannot be completely certain what was actually exfiltrated, while criminals have incentives to make claims that increase pressure and payment. Their work concluded that criminals may have strategic incentives to claim data exfiltration whether or not it actually occurred.

Now add another layer.

Even when theft definitely occurred, the victim cannot verify deletion afterward.

The attacker knows whether he retained a copy.

The victim does not.

That is a massive information asymmetry.

And unlike a broken decryptor, the deception may not become obvious immediately.

The victim can receive a functioning decryptor on Monday morning and know whether it works.

A supposedly deleted database might reappear six months later.

Or three years later.

Or never.

The victim cannot distinguish “they truly deleted it” from “they kept it but haven't used it yet.”

That is a terrible foundation upon which to purchase certainty.

And then the police opened LockBit's cupboards

This would be merely an interesting theoretical problem if law enforcement had not eventually obtained extraordinarily useful evidence.

In February 2024, an international operation led by Britain's National Crime Agency penetrated and seized infrastructure belonging to LockBit, at the time one of the world's largest ransomware operations.

Law enforcement was suddenly looking inside the organization.

And what investigators found speaks directly to our question.

According to the U.S. Department of Justice, seized LockBit infrastructure contained copies of data stolen from victims who had paid the ransom.

Those victims had allegedly been promised that their stolen information would be deleted after payment.

It wasn't.

FBI Cyber Division Assistant Director Bryan Vorndran later stated publicly that investigators determined LockBit and its affiliates were still holding information they had told paying victims had been deleted.

This is extraordinary evidence because it removes one layer of speculation.

We don't have to ask whether criminals might keep data.

In LockBit's case, investigators say they found it.

The ransomware gang had essentially been caught keeping copies of merchandise it had been paid to destroy.

That damages more than individual victims.

It attacks the logic of the entire extortion market.

The second ransom problem

Now we arrive at the point that triggered this discussion.

Suppose I steal your confidential database.

I demand $3 million.

I promise that payment will cause me to delete it.

You pay.

Six months later I return:

“Hello again. Remember that database I promised to delete? Apparently I still have it. Please send another $2 million.”

What exactly is my sales pitch?

Why would you believe that payment number two will accomplish what payment number one demonstrably did not?

I have destroyed my own leverage mechanism.

The FBI has explicitly warned victims about this possibility, noting that payment provides no guarantee the attacker has not downloaded data for resale or will not return for another round of ransom.

This does not mean nobody would ever pay twice.

Real-world decisions are messy.

A company might face new circumstances.

Different executives may be involved.

A threat against individual customers could create new pressure.

The data might have acquired greater sensitivity.

A desperate organization can make desperate decisions.

But as a repeatable business model, cheating creates a serious problem.

The first extortion depends upon fear.

The second depends upon fear and amnesia.

The ransomware lemon market

Economists have a useful concept called the “market for lemons.”

When buyers cannot distinguish good products from bad products, they become unwilling to pay premium prices because they fear receiving junk.

Something similar can happen with criminal promises.

Suppose some ransomware groups reliably provide working decryptors while others don't.

Reputation allows negotiators to differentiate them.

The reliable gang can effectively say:

“You hate us, correctly. But ask around. We deliver keys.”

That reputation supports payment.

Now move into data deletion.

No gang can easily prove it actually erased every copy.

Good actors—if we can momentarily abuse that word—and bad actors make the same promise:

“We'll delete it.”

The victim cannot reliably distinguish the gang that really will delete the files from the gang that intends to keep them.

The promises begin becoming economically indistinguishable.

Trust falls.

And that may push ransomware operators toward increasingly aggressive methods of coercion because simple assurances become less persuasive.

They need screenshots.

Samples.

Countdown clocks.

Leak sites.

Phone calls.

Threats against employees.

Threats to customers.

Threats to regulators.

The less credible the promise, the more important the threat becomes.

That is an ugly evolutionary path.

Reputation is valuable — until a new name costs twenty dollars

There is another weakness in criminal reputation markets.

Legitimate companies invest enormously in brands because abandoning a brand can be extremely expensive.

If Coca-Cola's reputation collapsed tomorrow, the company could not simply launch “DefinitelyNotCocaCola.ru” on Thursday and expect the entire market to transfer.

Cybercrime is different.

Criminal brands can disappear.

Code can be reused.

Infrastructure can be replaced.

Affiliates can migrate.

New leak sites can appear.

The British NCSC and NCA have noted that leaked ransomware source code rarely produces permanent disruption because criminals can start over and rebrand, while affiliates may switch brands when enforcement pressure damages a particular operation.

This places an upper limit on the disciplining power of reputation.

A gang with enormous brand equity has an incentive to protect it.

But if that brand becomes poisoned enough, the humans behind it may not have to repair it.

They may abandon it.

This is the cybercriminal version of declaring bankruptcy, growing a mustache and opening the same restaurant across the street.

“LockBit? Never heard of them.

Welcome to TotallyDifferentBit.”

That fluidity means criminal reputation is both valuable and disposable.

And that makes the marketplace inherently unstable.

Criminal honesty is not morality

This distinction deserves emphasis.

When a ransomware gang honors a payment, it has not become ethical.

It has made an investment.

The criminal's honesty is instrumental.

The gang keeps its word because keeping its word increases the expected value of future crimes.

This is not fundamentally different from a drug dealer caring about product consistency or an illegal marketplace banning vendors who repeatedly scam customers.

The market needs enough predictability to function.

Ransomware therefore creates an astonishing behavioral inversion.

The attack itself depends upon violating trust.

The business model depends upon rebuilding just enough trust to collect payment.

The attacker must simultaneously communicate:

“We are dangerous enough that you must believe our threat.”

and:

“We are reliable enough that you should believe our promise.”

That is an exceptionally delicate psychological position.

Too trustworthy and you are not frightening.

Too untrustworthy and there is no reason to pay.

The ideal professional extortionist must be perceived as:

terrible, competent and dependable.

There is probably no legitimate business school course for this.

Law enforcement can attack the reputation too

This suggests a fascinating defensive strategy.

Law enforcement traditionally attacks criminal infrastructure.

Seize the servers.

Freeze the cryptocurrency.

Arrest the operators.

Take down the leak site.

Recover decryption keys.

All of those things directly reduce criminal capacity.

But operations like the LockBit disruption did something else.

They attacked the brand promise.

When investigators publicly revealed that LockBit retained data belonging to victims who had paid for deletion, they supplied future victims with economically relevant information:

The contract may be worthless.

That matters.

A ransomware gang can rebuild a server.

It can register another domain.

It can compile another ransomware binary.

Rebuilding belief may be harder.

Reputation therefore becomes another attack surface for law enforcement.

Expose cheating.

Expose unreliable decryptors.

Expose internal theft.

Expose disputes between affiliates and operators.

Expose retained victim data.

The objective is not merely to make attacks technically difficult.

It is to make payment appear economically irrational.

Every future victim who says, “Why should we believe you?” reduces the extortionist's leverage.

Which brings us back to backups

This finally returns us to the original observation:

“We have good backups” is no longer a complete ransomware strategy.

Backups can defeat one form of leverage:

availability.

If criminals encrypt your files and you can restore them, their key becomes less valuable.

But backups do not restore confidentiality.

Once information has left the building, the defensive problem changes.

And crucially, payment cannot reliably restore confidentiality either.

That is the uncomfortable truth.

You can recover an encrypted file.

You cannot un-steal a stolen file.

You can rebuild a server.

You cannot prove that somebody in another country erased every copy of your customer database.

This is why organizations must increasingly think about ransomware not merely as a recovery problem but as a data-governance problem.

The less unnecessary sensitive information you retain, the less there is to steal.

The fewer people who can reach it, the harder it is to exfiltrate.

The better your monitoring, the greater the chance you can determine what actually left.

The better your segmentation, identity controls and retention policies, the less leverage an intruder can manufacture.

Backups remain essential.

But a backup protects possession.

It does not restore secrecy.

The world's least trustworthy trust economy

And perhaps that is the most fascinating thing about modern ransomware.

It has accidentally constructed an economy around trust between people who have every reason not to trust one another.

Victims must decide whether to trust criminals.

Affiliates must decide whether to trust ransomware operators.

Operators must decide whether to trust affiliates.

Initial-access brokers must trust buyers.

Buyers must trust brokers.

Money launderers must trust customers.

Everybody uses pseudonyms.

Everybody knows everybody else is committing crimes.

Nobody can call the police when the other party cheats.

And yet the machinery moves billions of dollars precisely because these actors create substitutes for conventional trust:

reputation, technical proof, escrow-like mechanisms, historical performance, organizational rules, market gossip and the threat of exclusion.

Ransomware's professionalization therefore contains the seed of its own contradiction.

To become resilient, the criminal organization must become predictable.

To become predictable, it must constrain its own freedom to cheat.

If it takes the money and refuses to decrypt, future victims learn.

If it promises deletion and keeps the files, future victims learn.

If it steals from affiliates, affiliates leave.

If it ignores every self-imposed rule, its rules stop carrying information.

Eventually the most sophisticated criminal organization can encounter a problem familiar to banks, governments, retailers and every other institution that depends upon confidence:

Nobody believes us anymore.

For the ransomware victim, that is useful knowledge.

The person demanding several million dollars may call the payment a settlement.

They may describe themselves as professionals.

They may promise a decryptor.

They may promise confidentiality.

They may promise deletion.

They may even provide “support.”

But there is an enormous difference between a criminal having an economic incentive to preserve his reputation and a victim possessing a guarantee.

LockBit demonstrated that difference rather spectacularly.

The criminals understood perfectly well that victims expected paid-for data to be deleted.

They apparently understood that this expectation helped make payment rational.

They promised deletion.

Then, according to investigators who seized their infrastructure, they kept copies anyway.

Which may be the perfect summary of ransomware's peculiar relationship with honesty:

The professional cybercriminal needs you to believe that there is honor among thieves.

The problem is that eventually someone gets access to the thieves' server.

And checks.

Jonathan Brown is a cybersecurity researcher and investigative journalist at bordercybergroup.com.

If you would like to support our work — useful, well-researched, ad-free cybersecurity intelligence — subscribe, comment, or buy us a coffee! Thanks.