BEGIN:VCALENDAR VERSION:2.0 PRODID:-//Talks.cam//talks.cam.ac.uk// X-WR-CALNAME:Talks.cam BEGIN:VEVENT SUMMARY:Examining Shocks to Ransomware Groups: The Effects of Law Enforcem ent Interventions and Internal Disputes on Leak Site Uptime - Tom Meurs\, Dutch Police DTSTART:20251118T140000Z DTEND:20251118T150000Z UID:TALK240760@talks.cam.ac.uk CONTACT:Alexandre Pauwels DESCRIPTION:Recording link: https://www.cl.cam.ac.uk/research/security/sem inars/archive/video/2025-11-18-t240760.html\n\nDouble-extortion ransomware has evolved into a complex ecosystem where public leak sites are critical for coercion and reputation building. In this study\, we examine the fact ors influencing the uptime of leak sites of 176 ransomware groups between December 2019 and March 2025\, treating leak site uptime as a proxy for gr oup survival. We investigate how external shocks\, such as law enforcement interventions like arrests\, takedowns\, financial seizures\, and interna l shocks\, such as affiliate disputes or leaks\, affect shutdown risks. Be yond shocks\, we analyze the role of organizational structure (e.g.\, tigh t-knit Eastern European crews versus decentralized RaaS models) and visibi lity/exposure (url count\, non-TOR presence) in shaping the likelihood of interventions and disputes. Using a two-stage modeling framework\, we firs t estimate the probability of external and internal shocks and then apply a Cox proportional hazards model to evaluate their impact on leak site upt ime. Our findings show that both external and internal shocks shorten upti me\, with the combined presence of both having the strongest effect. We fu rther show that it is hard to predict groups which might be prone to inter nal dispute\, while highly visible groups attract earlier law enforcement attention. These findings highlight the value of combining situational dis ruption with strategies that exploit internal ransomware group vulnerabili ties. LOCATION:Webinar &\; FW11\, Computer Laboratory\, William Gates Buildin g. END:VEVENT END:VCALENDAR