The Reading Room

Recommendations

A working shelf for anyone trying to understand the ransomware protection economy: the money, the metal, and the roof over both. Books, primary-source reports, and the feeds we check daily. Suggestions and additions are welcome, the list is meant to grow.

01Books · The Long Read

Narrative nonfiction that builds the mental model: how Russian and CIS crews operate, how the cash-out works, and why takedowns so often fail to stick.

Andy Greenberg · 2019

The definitive account of Russia's GRU-linked hacking unit and the NotPetya attack, the most destructive cyberattack in history. The clearest illustration of state-directed offensive operations and the impunity that follows them.

The Ransomware Hunting Team

Renee Dudley & Daniel Golden · 2022

A band of volunteer researchers who break ransomware and help victims recover without paying. Grounds the abstract ecosystem in the people fighting it and the technical realities of the malware itself.

Tracers in the Dark

Andy Greenberg · 2022

How investigators learned to follow cryptocurrency that was assumed to be untraceable, straight to the people behind it. Essential for understanding the Money layer: where the cash-out breaks and how it gets exposed.

Brian Krebs · 2014

Older but foundational: the inside story of Russian organized cybercrime and the pharma-spam empires that built the playbook. The cast of characters and the protection dynamics map directly onto today's ransomware economy.

Fancy Bear Goes Phishing

Scott J. Shapiro · 2023

A historian-of-ideas approach to five landmark hacks, including the GRU breach of the DNC. Strong on why systems stay insecure and how attacker incentives, not just code, shape outcomes.

This Is How They Tell Me the World Ends

Nicole Perlroth · 2021

The global market for software exploits, the raw material that fuels intrusions. Context for the supply side of the ecosystem and how vulnerabilities become weapons.

Countdown to Zero Day

Kim Zetter · 2014

The Stuxnet story, told with rigor. A useful baseline for how nation-state cyber operations are planned, deployed, and attributed, which informs how to read the protection layer.

02Reports & Primary Sources

The tracking numbers and policy frameworks behind the analysis. Treat these as the data layer: cite them, do not invent figures.

Chainalysis Crypto Crime Report

Chainalysis · Annual

The most-cited on-chain measurement of ransomware payment volumes, year over year. The reference point for sizing the Money layer and tracking whether pressure is working.

Ransomware Task Force: Combating Ransomware

Institute for Security and Technology · 2021, with annual progress reports

The cornerstone policy blueprint: 48 recommendations across Deter, Detect, Prepare, Respond. The progress reports are a useful scorecard on what governments have and have not done.

CISA #StopRansomware Advisories

CISA / FBI / partners · Ongoing

Joint advisories with indicators of compromise, TTPs, and named-group profiles. Primary-source technical detail straight from US government incident response.

Microsoft Digital Defense Report

Microsoft · Annual

Broad telemetry on nation-state and criminal activity at scale, including ransomware-as-a-service trends and the overlap between state and criminal operators.

03Ongoing Reading · Feeds & Reporting

Where the news actually breaks. Daily and weekly sources worth a standing tab.

KrebsOnSecurity

Brian Krebs · Blog

Deep, named investigations into cybercrime operators and infrastructure, frequently the first to attribute. Strong on the human network behind the brands.

Recorded Future News · Daily

Consistent, well-sourced coverage of ransomware incidents, takedowns, and sanctions. A reliable daily pulse on the ecosystem.

BleepingComputer

Lawrence Abrams et al. · Daily

Fast technical reporting on new strains, leak-site activity, and victim disclosures. Often the earliest public note on a group's moves.

Ransomware.live

Julien Mousqueton · Tracking feed

A live aggregator of ransomware leak-site postings and claimed victims. Useful raw signal for tracking group activity and rebrands over time.

04Contact

Have a recommendation, a tip, or a correction?

Suggestions for the shelf are welcome, and so are leads, data, and pushback on the analysis. Confidentiality respected. Use the address on the right.

Reach the project ransomwareedp@gmail.com