  Ransomware attacks are among the most severe cyber threats. They have made
headlines in recent years by threatening the operation of governments, critical
infrastructure, and corporations. Collecting and analyzing ransomware data is
an important step towards understanding the spread of ransomware and designing
effective defense and mitigation mechanisms. We report on our experience
operating Ransomwhere, an open crowdsourced ransomware payment tracker to
collect information from victims of ransomware attacks. With Ransomwhere, we
have gathered 13.5k ransom payments to more than 87 ransomware criminal actors
with total payments of more than $101 million. Leveraging the transparent
nature of Bitcoin, the cryptocurrency used for most ransomware payments, we
characterize the evolving ransomware criminal structure and ransom laundering
strategies. Our analysis shows that there are two parallel ransomware criminal
markets: commodity ransomware and Ransomware as a Service (RaaS). We notice
that there are striking differences between the two markets in the way that
cryptocurrency resources are utilized, revenue per transaction, and ransom
laundering efficiency. Although it is relatively easy to identify choke points
in commodity ransomware payment activity, it is more difficult to do the same
for RaaS.
