Pharos Report No. 4 – Assessing the Impact of Ransomware Interventions and Countermeasures: A Framework
Report published by Virtual Routes (Max Smeets and Bob Herczeg) and RUSI (Jamie MacColl and Sophie Williams-Dunning) Assessing the Impact of Ransomware Interventions and Countermeasures: A Framework
RANSOMWARE INTERVENTIONS
This report introduces a practical framework for evaluating ransomware interventions across four dimensions: severity, scope, longevity and reversibility, and signalling value. This structured approach enables graded assessments, distinguishes between actor-level and ecosystem-level effects, and makes trade-offs across different types of interventions explicit.
The fourth report of the Pharos Series, a joint project of Virtual Routes and Royal United Services Institute (RUSI), is authored by Max Smeets, Jamie MacColl, Sophie Williams-Dunning and Bob Herczeg.
The framework is illustrated through four cases — REvil, Emotet, Hive, and LockBit — demonstrating how different intervention designs generate distinct impact profiles. Overall, the report provides policymakers and operational teams with a consistent method to compare interventions, avoid equating publicity with impact, and strengthen long-term counter-ransomware strategy.
This project was made possible by the support of the German Federal Foreign Office. The views expressed in this paper do not necessarily represent the views or policies of the ministry or the government.
