As the relationship between cyber warfare and geopoltics continue to grow more intertwined, there is a growing need to understand how not only state actors but also commercially driven ransomware gangs interact within the cyber realm. Much of Cyber Threat Intelligence (CTI) focuses on technical methods of analyzing cyberattacks and various cyber criminal gangs. However, this study uses interviews conducted with operators in cyber criminal gangs over the dark web (Tor network) to understand the effects of geopolitics on ransomware gangs' targeting choices. Drawing from interviews with multiple groups, this study explores how ransomware gangs define targets as off-limits, respond to geopolitical situations, and political motivations behind their actions.
