{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,19]],"date-time":"2026-05-19T14:53:12Z","timestamp":1779202392817,"version":"3.51.4"},"reference-count":40,"publisher":"IEEE","license":[{"start":{"date-parts":[[2025,11,4]],"date-time":"2025-11-04T00:00:00Z","timestamp":1762214400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,11,4]],"date-time":"2025-11-04T00:00:00Z","timestamp":1762214400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/100018693","name":"Horizon Europe","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100018693","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2025,11,4]]},"DOI":"10.1109\/ecrime66972.2025.11327742","type":"proceedings-article","created":{"date-parts":[[2026,1,13]],"date-time":"2026-01-13T20:56:22Z","timestamp":1768337782000},"page":"1-13","source":"Crossref","is-referenced-by-count":1,"title":["Inside LockBit: Technical, Behavioral, and Financial Anatomy of a Ransomware Empire"],"prefix":"10.1109","author":[{"given":"Felipe","family":"Casta\u00f1o","sequence":"first","affiliation":[{"name":"Vicomtech (BRTA),Digital Security Department,Donostia\/San Sebastian,Spain"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Constantinos","family":"Patsakis","sequence":"additional","affiliation":[{"name":"University of Piraeus,Department of Informatics,Piraeus,Greece"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Francesco","family":"Zola","sequence":"additional","affiliation":[{"name":"Vicomtech (BRTA),Digital Security Department,Donostia\/San Sebastian,Spain"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Fran","family":"Casino","sequence":"additional","affiliation":[{"name":"Universitat Rovira i Virgili,Dept. of Computer Engineering and Mathematics,Catalonia,Spain"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref1","article-title":"Decoding the eu\u2019s most threatening criminal networks","year":"2024"},{"key":"ref2","article-title":"Iocta 2024","volume-title":"Internet Organised Crime Threat Assessment","year":"2024"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/Blockchain62396.2024.00041"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/DeSE54285.2021.9719456"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2020.101762"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1016\/S1353-4858(16)30086-1"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2018.08.008"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1007\/s41125-019-00039-8"},{"key":"ref9","article-title":"The changing dna of serious and organised crime","volume-title":"European Union Serious and Organised Crime Threat Assessment","year":"2025"},{"key":"ref10","article-title":"The 2025 Crypto Crime Report","year":"2025"},{"key":"ref11","article-title":"Ransomware as a service (raas) explained how it works & examples","author":"Baker","year":"2023"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-66245-4_16"},{"key":"ref13","article-title":"Understanding ransomware threat actors: Lockbit","year":"2023"},{"key":"ref14","article-title":"Ransomware double extortion and beyond: Revil, clop, and conti","author":"Agcaoili","year":"2021"},{"key":"ref15","article-title":"Law enforcement disrupt world\u2019s biggest ransomware operation","year":"2024"},{"key":"ref16","article-title":"LockBit power cut: four new arrests and financial sanctions against affiliates"},{"key":"ref17","article-title":"Annual Cyber Threat Monitor Report 2024","year":"2024"},{"key":"ref18","article-title":"State of ransomware in 2025","author":"Assolini","year":"2025"},{"key":"ref19","article-title":"Analysis of the lockbit 3.0 and its infiltration into advanced\u2019s infrastructure crippling nhs services","author":"Akinyemi","year":"2023"},{"key":"ref20","article-title":"Understanding Ransomware Threat Actors: LockBit","year":"2023"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1145\/3600160.3605047"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/ICCES51560.2020.9334643"},{"key":"ref23","first-page":"20253","article-title":"StealBit"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/APCCAS.2018.8605653"},{"key":"ref25","first-page":"20253","article-title":"Lockbit 3.0"},{"key":"ref26","first-page":"20253","article-title":"Lockbit 2.0"},{"key":"ref27","article-title":"The NCA announces the disruption of LockBit with Operation Cronos","year":"2024"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2019.2910058"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/SpaCCS63173.2024.00015"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/ICDMW.2018.00016"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/ICBC64466.2025.11185066"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/eCRS.2013.6805780"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.24251\/HICSS.2021.189"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-82349-7_20"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1093\/cybsec\/tyaf009"},{"key":"ref36","article-title":"LockBit attempts to stay afloat with a new version","year":"2024"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2023.103160"},{"key":"ref38","article-title":"StopRansomware: LockBit 3.0","year":"2023"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1016\/j.techsoc.2025.102956"},{"key":"ref40","article-title":"U.S. charges Russian national with developing and operating LockBit ransomware","year":"2024"}],"event":{"name":"2025 APWG Symposium on Electronic Crime Research (eCrime)","location":"San Diego, CA, USA","start":{"date-parts":[[2025,11,4]]},"end":{"date-parts":[[2025,11,7]]}},"container-title":["2025 APWG Symposium on Electronic Crime Research (eCrime)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/11326688\/11327697\/11327742.pdf?arnumber=11327742","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,1,14]],"date-time":"2026-01-14T07:02:55Z","timestamp":1768374175000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11327742\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,11,4]]},"references-count":40,"URL":"https:\/\/doi.org\/10.1109\/ecrime66972.2025.11327742","relation":{},"subject":[],"published":{"date-parts":[[2025,11,4]]}}}