Analysing the cultural dimensions of cybercriminal groups -- A case study on the Conti ransomware group

TL;DR

This paper introduces a novel approach to profiling cybercriminal groups by analyzing their cultural characteristics through internal communications, enhancing attribution accuracy and understanding of their modus operandi.

Contribution

It presents a systematic method for profiling cybercriminal groups using cultural analysis based on Hofstede and Meyer dimensions, demonstrated through a case study on the Conti ransomware group.

Findings

Cultural analysis can reveal insights into cybercriminal group behaviors.

Systematic cultural profiling aids in cyber-attack attribution.

The approach complements traditional cyber threat intelligence methods.

Abstract

Cybercriminal profiling and cyber-attack attribution have been elusive goals world-wide, due to their effects on societal and geopolitical balance and stability. Attributing actions to a group or state is a complex endeavour, with traditional established approaches including cyber threat intelligence and analysis of technical means such as malware analysis, network forensics, and geopolitical intelligence. However, we propose an additional component for profiling threat actor groups through analysing cultural aspects of human behaviours and interactions. We utilise a set of variables which determine characteristics of national and organisational culture to create a cultural "footprint" of cybercriminal groups. As a case study, we conduct thematic analysis across the six dimensions of the Hofstede national culture classification and the eight dimensions of the Meyer classification on leaked internal communications of the ransomware group Conti. We propose that a systematic analysis of similar communications can serve as a practical tool for a) understanding the modus operandi of cybercrime and cyberwarfare-related groups, and b) profiling cybercriminal groups and/or nation-state actors. Insights from such applications can, first, assist in combating cybercrime and, second, if combined with additional cyber threat intelligence, can provide a level of confidence in nuanced cyber-attack attribution processes.