Ransomware is still one of the most serious cybersecurity threats. Victims often pay but fail to regain access to their data, while also facing the danger of losing data privacy. These uncertainties heavily shape the attacker-victim dynamics in decision-making. In this paper, we introduce and analyze zkRansomware. This new ransomware model integrates zero-knowledge proofs to enable verifiable data recovery and uses smart contracts to enforce multi-round payments while mitigating the risk of data disclosure and privacy loss. We show that zkRansomware is technically feasible using existing cryptographic and blockchain tools and, perhaps counterintuitively, can align incentives between the attacker and the victim. Finally, we develop a theoretical decision-making frame- work for zkRansomware that distinguishes it from known ransomware decision models and discusses its implications for ransomware risk anal- ysis and response decision support.

翻译：勒索软件仍是最严重的网络安全威胁之一。受害者往往支付赎金却无法重新获取数据访问权限，同时还面临数据隐私泄露的风险。这些不确定性极大地影响了攻击者与受害者在决策过程中的动态关系。本文提出并分析了zkRansomware。这种新型勒索软件模型融合零知识证明以实现可验证的数据恢复，并利用智能合约强制执行多轮支付，同时降低数据泄露和隐私损失的风险。我们证明，利用现有的密码学和区块链工具，zkRansomware在技术上是可行的，并且——或许有违直觉地——能够协调攻击者与受害者之间的激励。最后，我们为zkRansomware建立了一个理论决策框架，该框架区别于已知的勒索软件决策模型，并探讨了其对勒索软件风险分析和响应决策支持的启示。