The security–efficiency trade-off in ransomware networks

Abstract

Ransomware groups pose a threat to both the economy and national security, yet little is known about their structural dynamics. This study analyses the Conti group using leaked Jabber encrypted instant messaging chat data (similar to Messenger) and Relational Event Models to examine how preferential attachment and triadic closure mechanisms shape its communication network. Findings show Conti prioritised efficiency through centralisation but mitigated risks via compartmentalisation, creating a hybrid structure that balances speed and secrecy. This adaptive approach enhances both effectiveness and resilience. The research provides new insights into the evolution of ransomware groups and suggests that disruption strategies should target internal cohesion rather than external infrastructure.