Fabian Teichmann
Abstract The boundary between traditional organized crime and cybercrime is eroding. Long-established criminal groups increasingly rely on encrypted communications, darknet markets, and cryptocurrency-based money laundering, while profit-driven cybercriminal groups adopt the durable structures, division of labor, and governance mechanisms long associated with organized crime. This article examines this convergence, understood as the organizational, operational, financial, and technological integration of traditional criminal groups and cybercriminal networks. The study combines a qualitative analysis of documents published between 2020 and 2026, including law enforcement reports, court records, and assessments by international organizations, with a case study of the Hive ransomware group and its disruption in 2023, complemented by supporting cases such as Conti, Hydra Market, EncroChat, and the online fraud compounds of Southeast Asia. Three vectors of convergence are identified: ransomware-as-a-service models and inter-group alliances; darknet marketplaces and the wider crime-as-a-service economy; and direct alliances between hackers and conventional criminal groups, including trafficking-based forced criminality. The article develops an integrative framework that links each vector to the organizational features it produces, to established criminological theories, and to corresponding enforcement levers. It concludes that convergence is a profit- and opportunity-driven adaptation to a weakly guarded digital environment and that effective responses require synchronized pressure on offenders, finances, infrastructure, and criminal service providers.