Many said that the ransom should not be paid, but did not offer any way to recover files others said that paying the ransom was the only way to recover files that had not been backed up. There was no guarantee that payment would release the encrypted content.Īlthough CryptoLocker itself was easily removed, the affected files remained encrypted in a way which researchers considered unfeasible to break. If the deadline was not met, the malware offered to decrypt data via an online service provided by the malware's operators, for a significantly higher price in bitcoin. The malware then displayed a message which offered to decrypt the data if a payment (through either bitcoin or a pre-paid cash voucher) was made by a stated deadline, and it threatened to delete the private key if the deadline passes. When activated, the malware encrypted certain types of files stored on local and mounted network drives using RSA public-key cryptography, with the private key stored only on the malware's control servers.

It propagated via infected email attachments, and via an existing Gameover ZeuS botnet. The attack utilized a trojan that targeted computers running Microsoft Windows, and was believed to have first been posted to the Internet on 5 September 2013. The CryptoLocker ransomware attack was a cyberattack using the CryptoLocker ransomware that occurred from 5 September 2013 to late May 2014. For other similar software, some using the CryptoLocker name, see Ransomware § Encrypting ransomware. This article is about specific ransomware software called CryptoLocker.

What is crypto locker