CryptoLocker: The Ransomware That Invented Modern Extortion
CryptoLocker was the first ransomware to use strong public-key cryptography and Bitcoin payments, making decryption impossible without paying. It infected over 500,000 Windows PCs and collected $27 million in ransoms.
Background
Before CryptoLocker, ransomware typically used weak encryption that security researchers could reverse-engineer. CryptoLocker, deployed in September 2013, changed the economics of ransomware permanently by using RSA-2048 combined with AES-256 — encryption that was computationally infeasible to break.
The Attack
CryptoLocker spread primarily through phishing emails with malicious ZIP attachments disguised as FedEx and UPS tracking notifications. When executed, it contacted command-and-control servers to exchange encryption keys, then encrypted documents, images, and other files on local drives and mapped network shares. A countdown timer informed victims they had 72 hours to pay 2 Bitcoin (then approximately $300) or the private key would be destroyed. The gang behind it, Gameover ZeuS, operated it as a service.
Response
Operation Tovar, a multinational law enforcement operation coordinated by the FBI, Europol, and private security firms, took down the Gameover ZeuS botnet in June 2014. Researchers obtained the database of private keys and created a free decryption tool (CryptoLocker Prevention Project). Evgeniy Bogachev, the alleged operator, was indicted but remains at large in Russia.
Outcome
CryptoLocker infected an estimated 500,000+ machines and extorted $27 million before being disrupted. It established the template for all subsequent ransomware: strong encryption, Bitcoin payments, time pressure, and professional customer service for paying victims. Every ransomware family since has followed this model.
Key Takeaways
- Offline backups that cannot be reached by ransomware are the only reliable recovery option
- Phishing emails disguised as shipping notifications are among the most effective malware delivery methods
- Network share mapping means a single infected workstation can encrypt all shared corporate files
- Strong asymmetric encryption makes paying the only recovery option if backups do not exist