History and stories
CryptoLocker: the ransomware that set the template
CryptoLocker showed a red screen, a deadline and a price. For files without a backup, there was no other way back.
1 min readStory
The short version
In 2013, ransomware with unbreakable encryption, a countdown clock and payment in Bitcoin turned file encryption into a business.
The story
CryptoLocker appeared in September 2013. It usually arrived as an email attachment that looked like a business document, such as a shipping notice or a voicemail. It was also pushed onto computers already infected with other malware.
Once running, it encrypted documents, spreadsheets and pictures on the computer and on any network drives it could reach. Then it displayed a message with a countdown: pay within a few days, in Bitcoin or a prepaid voucher, or the key needed to unlock the files would be destroyed.
The encryption could not be broken. Some victims paid; some who paid never got their files back. Businesses and even a police department in Massachusetts paid to recover their data.
In May 2014, an international operation took down the network used to spread it. Researchers recovered the attackers’ keys and built a free tool to unlock files.
Why it mattered
Ransomware had existed before, but CryptoLocker made it work at scale: strong encryption, an anonymous payment method and a clear deadline. Many later ransomware groups copied its approach.
The lesson today
The network drives were encrypted too. Any backup that the infected computer can write to can be destroyed the same way. Backups need a copy the infected computer cannot touch, and regular tests to prove they restore.
Talk to us about your technology
Tell us what you run today and what is getting in the way. We will get back to you about how we can help.