[ndury]

Nice writeup! I have always been interested in how ransomware works and to what extent the transactions can be backtraced. It still surprises me that these attackers seemingly are unaware to what extent bitcoin blockchain transactions can be traced. It certainly took them long enough to make the switch to Monero.

[mountsbay]

That Locky simply moved 40% of their revenue into BTC-e (Figure 8), without going through mixers, is likely just bad op-sec.