How do ransomware groups choose their targets? An empirical analysis

Ransomware groups vary in the types of organizations they compromise, yet little empirical work has examined whether these differences extend to the technology stacks of victims. We analyze 5,190 ransomware incidents across 151 groups, linking each victim to its observed technology stack from the SWDB Company Intelligence database. We find that some enterprise software is associated with greater ransomware risk than others, and that this association is often stronger for technologies carrying more known vulnerabilities. Next, by analyzing leaked chat logs of leading ransomware groups, we present direct evidence that some groups choose their victims based on observed technology use and revenue data gathered through opensource intelligence. Finally, examining the full population of victims, we find that some groups concentrate on particular technologies and revenue profiles, while others appear more opportunistic, with a victim profile close to the overall population.