Abstract
For more than a decade, businesses and private citizens alike have been tormented by an online phenomenon that has changed our stance on cyber security. Ransomware, malicious software that demands payment in exchange for a stolen functionality, has grown beyond expectations. The development and distribution of ransomware is stimulated by social networks active in the Dark Net. From the cyber criminal perspective, this is an ideal platform to participate in a business ecosystem, either as an author, vendor or distributor of ransomware. Within the Dark Net, they can find forums and marketplaces that offer complete secrecy and concealment of the user's identity. Studying the activities taking place within the Dark Net sites can improve our situational awareness on upcoming threats and how we can defend against them. In this research, a netnographic study was done to obtain useful data such as observations of the marketplace economies and reflections on the social interactions between the different stakeholders involved in the creation and distribution of ransomware.