Figure 2 illustrates the ten most frequently addressed criminal acts. Cyber extortion, including ransomware, emerges as the most successful addressed offense. This is followed closely by malware distribution and unauthorized access or intrusion. Together, these categories dominate law enforcement activity and highlight how financially motivated cybercrime is addressed most.Figure 2 illustrates the ten most frequently addressed criminal acts. Cyber extortion, including ransomware, emerges as the most successful addressed offense. This is followed closely by malware distribution and unauthorized access or intrusion. Together, these categories dominate law enforcement activity and highlight how financially motivated cybercrime is addressed most.

Figure 3: All Law Enforcement actions in percentage 

Additional measures such as sentencing, sanctions, and asset seizures indicate that law enforcement increasingly targets both individuals and the economic foundations of cybercrime. Sanctions, in particular, have grown steadily over time and reflect the expanding role of economic and diplomatic tools within cybercrime enforcement.

Figure 4 combines criminal acts with law enforcement responses and shows that arrests dominate across nearly all crime categories, especially cyber extortion and hacking. Takedowns are strongly associated with dark web marketplaces and malware infrastructure, while sanctions appear primarily in cases related to cyber espionage and state aligned activity.

Figure 5 highlights the leading countries involved in cybercrime enforcement. The United States stands out as the most active participant, acting as the primary lead in 45 percent of all recorded actions. A second cluster consisting of Germany, the United Kingdom, Russia, Ukraine, the Netherlands, Spain, and France forms the core of global cyber enforcement capacity outside the United States.

Figure 7 shows that cybercrime in this dataset is predominantly an adult activity. The largest share of offenders falls within the 35 to 44 age group, followed by those aged 25 to 34 and 18 to 24. Unlike traditional crime patterns that peak in adolescence, cyber offending appears to persist well into adulthood, suggesting sustained and deliberate engagement rather than impulsive behavior. While middle-aged offenders feature prominently in this dataset, younger offenders are likely underrepresented, since minors are often shielded from prosecution and public disclosure under national legal frameworks, limiting their visibility in law enforcement reporting.

Nevertheless, the age distribution of offenders in this dataset challenges traditional criminological assumptions. Foundational research on the age-crime curve suggests that criminal behavior typically peaks in adolescence or early adulthood before declining sharply. In contrast, cyber offending in this dataset is concentrated among adults, with the 35-44 age group representing the largest share of identified offenders.

This sustained engagement into mid-life suggests that cybercrime often involves deliberate and cognitively informed decision-making rather than impulsive or situational behavior. These findings align with rational choice perspectives, where offenders weigh risks, rewards, and opportunities over time.

Figure 8 illustrates how offense types vary by age. Younger offenders are more frequently involved in technically oriented activities such as hacking and DDoS attacks, which may be exploratory or reputational in nature. As age increases, involvement shifts toward profit driven and complex activities, including cyber extortion, malware deployment, cyber espionage, and money laundering.

Figure 9 shows a pronounced gender imbalance, with more than 90 percent of identified offenders being male. This mirrors broader patterns observed in both cybercrime research and the cybersecurity workforce.

Figure 9: Offender’s gender

Figure 10 presents offender nationality data, revealing representation from 64 different nationalities. The distribution is heavily concentrated, with Russian nationals representing the largest single group, followed by American, Chinese, Ukrainian, and North Korean offenders. While nationality offers only partial insight in a transnational digital environment, it provides useful context for understanding regional enforcement visibility and geopolitical factors.