Virtual Routes is pleased to release the second report in the Pharos Series, The Ransomware Trust Paradox by Max Smeets.
Ransomware groups operate in a paradox: despite being inherently deceptive actors, they rely on cultivating trust with their victims. This trust – vital to ensuring ransom payments – is premised on assurances that paying will lead to decryption and data confidentiality. Max Smeets terms this dynamic the Ransomware Trust Paradox and argues it is central to understanding the persistence and success of ransomware as a cyber threat.
This report examines how ransomware groups establish trust through branding, reputation, and communication strategies. Drawing on case studies including DarkSide, BlackCat, and Conti, it shows how these groups carefully manage their public image, issue statements to correct reporting, and operate structured ‘customer support’ to appear reliable. Brand diversification further allows them to evade sanctions and re-extort former victims under new names.
Despite this centrality of trust, current government responses largely overlook it. International initiatives like the Counter Ransomware Initiative and Ransomware Task Force have focused on technical disruption and resilience but fail to address the reputational underpinnings of ransomware groups.
Smeets calls for a new counter-ransomware strategy that includes undermining these groups’ credibility. This includes journalist training and the development of a code of ethics for ransomware reporting – drawing lessons from disinformation and counterterrorism fields – to reduce unintentional amplification of ransomware groups’ power and legitimacy.
The report concludes that undermining trust is a critical and underused lever in ransomware policy. A more deliberate approach to how ransomware is reported and understood can help weaken the foundations on which these criminal enterprises rely.
Read the report below.
This report is a part of the Pharos Series, a new series shedding light on cybersecurity and emerging technology challenges. The series aims to offer clear expert insights helping policymakers, researchers, and practitioners navigate evolving threats.
