Security Navigator 2027 · Law enforcement
What Takedowns Really Do to the Minds of Ransomware Gangs
Security Navigator 2027 launches in:
days
hours
minutes
seconds
Law enforcement is more active and visible than ever. Our researchers looked past the seized servers and the arrests – at what a takedown does to the people who are still out there.
Quick quiz: Law enforcement is more active than ever. What happened to extortion?
Be among the first readers of the Security Navigator 2027!
Be among the first readers of the Security Navigator 2027!
Be among the first readers of the Security Navigator 2027!
Be among the first readers of the Security Navigator 2027!
What was the paradox we set out to explain?
More arrests. More seized servers. More sanctions. So what is all of that doing to extortion? Our security research team built a dataset of publicly disclosed law-enforcement actions since 2020 and set it against leak-site data and the criminals’ own words. Their lens is criminology, not headlines: what a takedown does to trust, uncertainty and the way gangs judge their own risk – and whether they rebuild, rebrand or walk away.
How we counted
The research combines our dataset of publicly disclosed law-enforcement actions with leak-site data and with what the groups themselves say – on leak sites, in affiliate discussions and in public statements. It does not treat a takedown as simply a success or a failure. It asks how severe the effects were, how long they last, and whether they can be reversed.
Answers you will find in the Navigator?
- Law enforcement is turning up the pressure. Cyber extortion isn’t slowing down. Where’s the catch?
- What do criminals’ own words reveal about fear and mistrust after an intervention?
- Can a takedown destabilize a criminal group and still make it more resilient?
- Does a ransomware group’s comeback mean the disruption failed?
- When law enforcement disrupts one group, who else feels the pressure?
An intervention's technical reach may end with the immediate target, while its cognitive ripple effects travel further.
– Zohra Hamila, Security Researcher
Take it to your team!
- If the group targeting our industry were taken down tomorrow, would our risk drop – or just move?
- Would we report an extortion attempt to the police – and do we know whom to call?
- Does our incident plan assume attackers are gone after a takedown?
- Have we decided in advance whether we would ever pay – and who makes that call?
- Do we track rebranded or returning groups that have targeted our industry?
Explore some other questions:
Can a fake protest movement target your brand? → Explore | Cognitive
Did the AI attack wave arrive – or something else? → Explore | AI
Your biggest insider risk – malicious or well-meaning? → Explore | Threat Detection
How many extortion gangs are active – and who leads? → Explore | Cy-X
The CVE flood: did it reach real networks? → Explore | Vulnerabilities
Be among the first readers of the Navigator 2027!
