Rutger Leukfeldt
Biographic Data
| ID | 1321902 |
|---|---|
| NAME | Rutger Leukfeldt |
| GIVEN NAMES | Rutger |
| FAMILY NAME | Leukfeldt |
| SIGNATURE | LEUKFELDT R |
| AFFILIATIONS | Netherlands Institute for the Study of Crime and Law Enforcement |
| ORCID | 0000-0002-3051-0859 |
| VERIFIED | Yes |
| TOTAL WORKS | 43 |
| TOTAL CITATIONS | 119 |
| AUTHOR COUNT | 43 |
| EDITOR COUNT | 0 |
| FIRST PUBLICATION YEAR | 2013 |
| LATEST PUBLICATION YEAR | 2026 |
| H-INDEX | 6 |
Exploring Victim-Offender Interactions During a Ransomware Attack Using LockBit Chat Negotiations
This study explores interactions between ransomware victims and offenders through a qualitative analysis of chat negotiations of the LockBit ransomware group (n=147), providing insight into data exfiltration, extortion, communication and negotiation, payment, and post-payment outcomes. The findings show that both offenders and victims employ bounded rational decision-making. For offenders, this is exemplified by aspects such as tailor-made ransom…
Examining Financial Trails of Online Frauds and Money Laundering Choices of Cybercriminals
While many cybercrimes are financially motivated, the financial aspects of cybercrime remain insufficiently understood. The aim of this study is to provide greater insight into the financial trails of online fraud and the choices of cybercriminals in the concealment of illicit proceeds. To do so, we utilize data from 15 completed police investigations into cybercriminal networks in the Netherlands and apply financial crime scripting as an analyti…
The psychological correlates of cybercrime offending
This study sought to explore the relationship between low self-control, social learning, and serious forms of cybercrime offending. Using general population survey data from 1240 Dutch young people, we ran a series of binary logistic regression models to estimate the role of various risk variables for engaging in four cyber-dependent crimes: guessing passwords, DoS/DDoS attacks, hacking with technological means, and website defacements. The analy…
Exploring trust signals and pathways on cybercrime-as-a-service markets
As digital technologies evolve, Cybercrime-as-a-Service (CaaS) markets make sophisticated tools, such as Remote Access Trojans (RATs), available to individuals with limited technical expertise. By reducing technical complexity and perceived risk, these markets may create new pathways into cybercrime. Using Gambetta’s (2009) signaling theory of trust, this study explores how CaaS markets trading RATs facilitate involvement into cybercrime. A multi…
From the street to the internet? Exploring hybrid offending among financially motivated cybercriminals
The involvement process for financial-economic cyber-enabled crime
This paper examines the involvement process of youth in financial cybercrime, focusing on preexisting ties and offender convergence settings. Based on interviews with 25 experts, and analysis of five criminal cases, we find that preexisting offline ties remain the most crucial, especially for core group members and money mules. This persistence is likely because such ties foster trust, reducing perceived risks in co-offending. At the same time, v…
Online criminal markets on telegram
This study empirically examines illicit products and services advertised on Telegram. The dataset comprised over 26 million messages posted by more than 88,000 users in 31 public Dutch Telegram groups over a two-year period. Qualitative analysis identified 77 unique illicit products and services, grouped into 13 overarching crime categories, alongside a non-crime-related category. Descriptive analyses show that narcotics was the dominant category…
Taking matters into their own hands
Online fraud poses a significant global threat with profound consequences for victims, organisations and society. Despite its high prevalence and impact, law enforcement faces challenges in effectively addressing online fraud. In addition to reporting to the police, victims can pursue civil litigation to recover financial damages. In the Netherlands, opportunities for pursuing civil action have expanded since 2021. To facilitate damage recovery, …
Violence, Conflicts and Weapons in the World of Financial–Economic Cybercrime
The digitization of society has facilitated cafeteria-style offending behaviours among financially motivated offenders: offenders exploit technological possibilities to enhance already existing crime scripts. This raises questions about the presence of offline crime elements in the commission of online crimes. Specifically, the current study explores how physical violence and threats are embedded in the realm of financial–economic cybercrime thro…
The evolution of Nigerian cybercrime
Thus far, the literature on cybercrime has focussed on ‘cyber-dependent’, rather than ‘cyber-enabled’ crime. This has meant the emphasis has been on online settings, technical offences, and Western cybercriminals. This paper seeks to partially address these gaps through focussed qualitative case study analyses of two Nigerian offender networks based in Europe, which were both engaged in cyber-enabled fraud and had a strong offline component. We s…
Interest in booter services and distributed denial of service attacks
Cybercrime as a service is lowering the barrier to entry for crime. Aspiring criminals can access cybercrime services through the clear web using search engines. One such cybercrime service is booters, web platforms that offer affordable distributed denial of service attacks for hire. Law enforcement agencies have tried to counter this trend by running online ad campaigns on platforms like Google. For these campaigns to effectively divert and det…
The involvement mechanisms of cybercrime
Money muling is an urgent problem among young people. Money mules refer to individuals whose bank account is used to hide and launder the profits of financial-economic cybercrimes. They are key actors in the cybercriminal ecosystem. In order to add to the current body of knowledge and better understand and disrupt pathways into cybercrime, this study explores which individual factors relate to previous exposure to money mule recruiters. Drawing u…
Unraveling the Human Factor in Cybercrime
This special issue presents cutting-edge research on the human factor in cybercrime, exploring the evolving dynamics of cybercriminal activities. It covers two primary themes: offender-focused studies, which investigate emerging profiles and tactics, and victim-centered studies, examining risk factors, impacts, and protective strategies. The issue stems from the fifth annual conference on the Human Factor in Cybercrime (HFC conference) in Halle (…
Examining ransomware payment decision-making among small- and medium-sized enterprises
Ransomware is currently one of the most prominent cyberthreats for organizations. Small- and medium-sized enterprises are particularly vulnerable to ransomware victimization and more inclined toward paying the ransom. However, while a few studies have been conducted on victimization of ransomware, little is known about how small- and medium-sized enterprises respond to victimization and what factors contribute to the decision to pay the ransom. T…
Specialization in cybercrime and offense versatility during early adolescence and the role of criminogenic needs
This study explores the intertwinement of cybercrime and traditional crime during early adolescence. We designed a cross-sectional survey compromising previously validated instruments, which was completed by 1,240 young people from the Netherlands. This survey measured the lifetime prevalence and past-year frequencies of a number of offending behaviors, and screened for key criminogenic needs. Analysis revealed that around half of the cybercrime …
Exploring cybercrime and traditional crime on Telegram in the Netherlands
This study explores cybercrime and traditional crime on Telegram in 26 Dutch group chats. We leverage a dataset compromising 3.5 million messages posted by more than 37,000 users in a one-year timeframe. These messages were related to various illicit goods and services, including hard drugs and phishing kits. Descriptive analysis revealed that traditional crime markets were larger than cybercrime markets in terms of number of users and number of …
Exploring the factors that differentiate individual and group offenders in cyber-dependent crime
Fear of cybercrime victimisation
To report or not to report
Risk Profiles for Cybercrime Victimization
Bottlenecks and Opportunities for Improvement in Cybercrime Handling
This study examines the handling of cybercrime cases by law enforcement officers, focusing on bottlenecks and potential improvements noted by experts in the field. Building on previous research, this study identifies persistent issues such as low prioritization, a lack of capacity, knowledge gaps, and case complexity. Respondents advocate for the centralized processing of online crime reports to enhance data aggregation, improve detection of over…
Hacktivism
Stolen data markets on Telegram
Cybercriminal networks in the UK and Beyond
This article examines the network structure, criminal cooperation, and external interactions of cybercriminal networks. Its contribution is empirical and inductive. The core of this study involved carrying out 10 case analyses on closed cybercrime investigations – all with financial motivations on the part of the offenders - in the UK and beyond. Each analysis involved investigator interview and access to unpublished law enforcement files. The co…
Recruiting co-offenders for financial cybercrime
Applying Routine Activity Theory to Cybercrime
The central question of this article is whether routine activity theory (RAT) can be used as an analytical framework to study cybercrimes. Both a theoretical analysis and an analysis of empirical studies have thus far failed to provide a clear answer. The multivariate analysis presented in this article tries to avoid some of the limitations of other RAT-based studies. Based on a large sample (N = 9,161), the effects of value, visibility, accessib…
Cybercriminal Networks, Social Ties and Online Forums
To gain insight into these questions, we analysed 18 criminal investigations into phishing and malware networks and developed four models of growth. Social ties still play an important role in the origin and growth of the majority of networks. Forums, however, also play a significant role in a number of networks, for example, to find suitable co-offenders or to get into contact with enablers. Criminals with access to forums are able to increase c…
The Hybridization of Street Offending in the Netherlands
Based on the results of two research projects from the Netherlands, this paper explores how street-oriented persons adapt and use digital technologies by focussing on the changing commission of instrumental, economically motivated, street crime. Our findings show how social media are used by street offenders to facilitate or improve parts of the crime script of already existing criminal activities but also how street offenders are engaging in cri…
Money Mules and Cybercrime Involvement Mechanisms
Money mules play an essential role in the execution of financially-motivated cybercrimes. The bank accounts of money mules, who are often young individuals, are used to hide and launder stolen money, allowing members of cybercriminal networks to maintain their anonymity. In order to better understand the pathways that lead to cybercrime, this explorative study aims to map the experiences and perceptions of Dutch young people related to money muli…
Recruiting money mules on instagram
There are reports that criminal networks advertise on social media to recruit new members. In this paper, we will focus on money mules and examine how they become involved in cybercrime on Instagram. Money mules are used to hide the financial trail of a crime and are thus indispensable for cybercriminal networks. Yet, there is a dearth of research on this group. Based on keywords derived from the literature, 43 Dutch Instagram accounts were ident…
Cybercrimes on the Streets of the Netherlands? An Exploration of the Intersection of Cybercrimes and Street Crimes
This article explores the intersections of street crimes and cybercrimes. Fourteen Dutch criminal investigations into networks that committed cybercrimes were analyzed to gain insight into offline and local dimensions of these activities. Firstly, we examined whether the networks in these cases are also involved in other criminal activities than cybercrimes. Secondly, we analyzed the origin and growth of these networks, with specific attention fo…
Hacktivism
Testing an Integrated Self-Control and Routine Activities Framework to Examine Malware Infection Victimization
Recent research demonstrates that those with low self-control have an increased risk of victimization due to involvement in routine activities that place them in close proximity to motivated offenders and decrease their willingness to utilize appropriate guardianship factors. This relationship is significant in predicting physical forms of victimization, though few studies have considered how this may account for property offenses, particularly f…
The Use of Online Crime Markets by Cybercriminal Networks
In this article, we study the various functions of online cybercriminal meeting places from a unique perspective: We do not take the criminal meeting place as a starting point, but the users-the criminal networks. This allows not only for a view of what is happening on online meeting places, but it also places online meeting places into perspective. Our data consisted of detailed case descriptions of 40 cybercriminal networks active in the Nether…
The effect of online ad campaigns on DDoS‐attacks
Research Summary European law enforcement agencies have begun to use targeted online ad campaigns to raise cybercrime awareness among at‐risk populations. Despite their rapid proliferation, there is little research to support their efficacy and effectiveness. This study uses a quasi‐experimental difference‐in‐differences design to evaluate the effect of seven campaigns deployed in 2021 and 2022 on the volume of (distributed) denial‐of‐service or …
Double, triple or quadruple hits? Exploring the impact of cybercrime on victims in the Netherlands
This article explores the impact of online crime victimisation. A literature review and 41 interviews – 19 with victims and 22 with experts – were carried out to gain insight into this. The interviews show that most impacts of online offences correspond to the impacts of traditional offline offences. There are also differences with offline crime victimisation. Several forms of impact seem to be specific to victims of online crime: the substantial…
Employment Opportunities for Applicants with Cybercrime Records
Various studies have shown that convicted offenders often face difficulties in finding employment. These studies, however, only examined traditional types of crime and little is known about the job opportunities of convicted cybercrime offenders. Therefore, this study examines the influences of being convicted for a cybercrime on labour market chances in the IT sector in the Netherlands. An experiment was conducted in which fictitious job applica…
Child pornography, the Internet and juvenile suspects
An example of a recurrent issue in communities is the legal system's struggle to process problems of young offenders. The main focus of this article is juvenile suspects of crimes considering child pornography. Two topics are discussed: the nature of these crimes and the characteristics of suspects. An analysis of 159 Dutch police files on child pornography shows that almost a quarter of the suspects are under 24 years of age. Of that group, 35% …
Cybercriminal Networks, Social Ties and Online Forums
To gain insight into these questions, we analysed 18 criminal investigations into phishing and malware networks and developed four models of growth. Social ties still play an important role in the origin and growth of the majority of networks. Forums, however, also play a significant role in a number of networks, for example, to find suitable co-offenders or to get into contact with enablers. Criminals with access to forums are able to increase c…
Applying Routine Activity Theory to Cybercrime
The central question of this article is whether routine activity theory (RAT) can be used as an analytical framework to study cybercrimes. Both a theoretical analysis and an analysis of empirical studies have thus far failed to provide a clear answer. The multivariate analysis presented in this article tries to avoid some of the limitations of other RAT-based studies. Based on a large sample (N = 9,161), the effects of value, visibility, accessib…
The Use of Online Crime Markets by Cybercriminal Networks
In this article, we study the various functions of online cybercriminal meeting places from a unique perspective: We do not take the criminal meeting place as a starting point, but the users-the criminal networks. This allows not only for a view of what is happening on online meeting places, but it also places online meeting places into perspective. Our data consisted of detailed case descriptions of 40 cybercriminal networks active in the Nether…
Testing an Integrated Self-Control and Routine Activities Framework to Examine Malware Infection Victimization
Recent research demonstrates that those with low self-control have an increased risk of victimization due to involvement in routine activities that place them in close proximity to motivated offenders and decrease their willingness to utilize appropriate guardianship factors. This relationship is significant in predicting physical forms of victimization, though few studies have considered how this may account for property offenses, particularly f…
An Examination of Motivation and Routine Activity Theory to Account for Cyberattacks Against Dutch Web Sites
This study provides a partial test of the relationship between actor motivations and target suitability using a routine activity framework to understand a form of cybercrime called web defacements. Specifically, the relationships between the visibility, inertia, value, and accessibility of the target in online spaces relative to the unique nonmonetary motivations of the attacker were examined. This study utilized a sample of 138,361 web defacemen…
Double, triple or quadruple hits? Exploring the impact of cybercrime on victims in the Netherlands
This article explores the impact of online crime victimisation. A literature review and 41 interviews – 19 with victims and 22 with experts – were carried out to gain insight into this. The interviews show that most impacts of online offences correspond to the impacts of traditional offline offences. There are also differences with offline crime victimisation. Several forms of impact seem to be specific to victims of online crime: the substantial…
The Hybridization of Street Offending in the Netherlands
Based on the results of two research projects from the Netherlands, this paper explores how street-oriented persons adapt and use digital technologies by focussing on the changing commission of instrumental, economically motivated, street crime. Our findings show how social media are used by street offenders to facilitate or improve parts of the crime script of already existing criminal activities but also how street offenders are engaging in cri…
Cybercrimes on the Streets of the Netherlands? An Exploration of the Intersection of Cybercrimes and Street Crimes
This article explores the intersections of street crimes and cybercrimes. Fourteen Dutch criminal investigations into networks that committed cybercrimes were analyzed to gain insight into offline and local dimensions of these activities. Firstly, we examined whether the networks in these cases are also involved in other criminal activities than cybercrimes. Secondly, we analyzed the origin and growth of these networks, with specific attention fo…
Unraveling the crime scripts of phishing networks
Cybercrime on the menu? Examining cafeteria-style offending among financially motivated cybercriminals
Criminologists have frequently debated whether offenders are specialists, in that they consistently perform either one offense or similar offenses, or versatile by performing any crime based on opportunities and situational provocations. Such foundational research has yet to be developed regarding cybercrimes, or offenses enabled by computer technology and the Internet. This study address this issue using a sample of 37 offender networks. The res…
High tech crime, high intellectual crime? Comparing the intellectual capabilities of cybercriminals, traditional criminals and non-criminals
In our highly digitalized society, cybercrime has become a common crime. However, because research into cybercriminals is in its infancy, our knowledge about cybercriminals is still limited. One of the main considerations is whether cybercriminals have higher intellectual capabilities than traditional criminals or even the general population. Although criminological studies clearly show that traditional criminals have lower intellectual capabilit…
Repeat victimization by website defacement
Repeat victimization has been widely studied from the perspective of environmental criminology for several decades. During this period, criminologists have identified a set of repeat victimization premises that are observed for many crimes; however, it is unknown whether these premises are also valid for cybercrime. In this study we rely on more than 9 million Zone-H data records from 2010 to 2017 to test whether these premises apply for the cybe…
Employment Opportunities for Applicants with Cybercrime Records
Various studies have shown that convicted offenders often face difficulties in finding employment. These studies, however, only examined traditional types of crime and little is known about the job opportunities of convicted cybercrime offenders. Therefore, this study examines the influences of being convicted for a cybercrime on labour market chances in the IT sector in the Netherlands. An experiment was conducted in which fictitious job applica…
Your files have been encrypted
The effect of online ad campaigns on DDoS‐attacks
Research Summary European law enforcement agencies have begun to use targeted online ad campaigns to raise cybercrime awareness among at‐risk populations. Despite their rapid proliferation, there is little research to support their efficacy and effectiveness. This study uses a quasi‐experimental difference‐in‐differences design to evaluate the effect of seven campaigns deployed in 2021 and 2022 on the volume of (distributed) denial‐of‐service or …
Money Mules and Cybercrime Involvement Mechanisms
Money mules play an essential role in the execution of financially-motivated cybercrimes. The bank accounts of money mules, who are often young individuals, are used to hide and launder stolen money, allowing members of cybercriminal networks to maintain their anonymity. In order to better understand the pathways that lead to cybercrime, this explorative study aims to map the experiences and perceptions of Dutch young people related to money muli…
Recruiting money mules on instagram
There are reports that criminal networks advertise on social media to recruit new members. In this paper, we will focus on money mules and examine how they become involved in cybercrime on Instagram. Money mules are used to hide the financial trail of a crime and are thus indispensable for cybercriminal networks. Yet, there is a dearth of research on this group. Based on keywords derived from the literature, 43 Dutch Instagram accounts were ident…
Stolen data markets on Telegram
Cybercriminal networks in the UK and Beyond
This article examines the network structure, criminal cooperation, and external interactions of cybercriminal networks. Its contribution is empirical and inductive. The core of this study involved carrying out 10 case analyses on closed cybercrime investigations – all with financial motivations on the part of the offenders - in the UK and beyond. Each analysis involved investigator interview and access to unpublished law enforcement files. The co…
Recruiting co-offenders for financial cybercrime
The evolution of Nigerian cybercrime
Thus far, the literature on cybercrime has focussed on ‘cyber-dependent’, rather than ‘cyber-enabled’ crime. This has meant the emphasis has been on online settings, technical offences, and Western cybercriminals. This paper seeks to partially address these gaps through focussed qualitative case study analyses of two Nigerian offender networks based in Europe, which were both engaged in cyber-enabled fraud and had a strong offline component. We s…
Interest in booter services and distributed denial of service attacks
Cybercrime as a service is lowering the barrier to entry for crime. Aspiring criminals can access cybercrime services through the clear web using search engines. One such cybercrime service is booters, web platforms that offer affordable distributed denial of service attacks for hire. Law enforcement agencies have tried to counter this trend by running online ad campaigns on platforms like Google. For these campaigns to effectively divert and det…
The involvement mechanisms of cybercrime
Money muling is an urgent problem among young people. Money mules refer to individuals whose bank account is used to hide and launder the profits of financial-economic cybercrimes. They are key actors in the cybercriminal ecosystem. In order to add to the current body of knowledge and better understand and disrupt pathways into cybercrime, this study explores which individual factors relate to previous exposure to money mule recruiters. Drawing u…
Unraveling the Human Factor in Cybercrime
This special issue presents cutting-edge research on the human factor in cybercrime, exploring the evolving dynamics of cybercriminal activities. It covers two primary themes: offender-focused studies, which investigate emerging profiles and tactics, and victim-centered studies, examining risk factors, impacts, and protective strategies. The issue stems from the fifth annual conference on the Human Factor in Cybercrime (HFC conference) in Halle (…
Cybercrime and Law Enforcement Studies (43 works) · Computer Science (30 works) · Crime Patterns and Interventions (29 works) · Cybercrime (29 works) · The Internet (29 works) · Crime, Illicit Activities, and Governance (24 works) · Criminology (24 works) · Psychology (23 works) · Computer security (21 works) · World Wide Web (21 works)