The Ransomware Playbook and How to Disrupt It

Over the years, ransomware groups have improved their ‘playbooks’. This report looks at government actions that aim to counter this new ransomware playbook. Based on the Virtual Routes Ransomware Countermeasures Tracker and insights from Ransom War: How Cybercrime Became a Threat to National Security, the report highlights what is working, what is missing, and where policy needs to go next.

The first part lays out the playbook of ransomware groups in 11 stages, followed by a discussion about what governments have achieved so far in disrupting ransomware groups across these stages. The last section emphasizes the need for stronger national strategies and enhanced international collaboration to combat ransomware effectively.

The report aims to offer clear expert insights helping policymakers, researchers, and practitioners navigate evolving threats.