The Latest in IT Security

Cryptolocker weekly haul? More than 10k victims

13
Nov
2013

Bitdefender Labs researchers have reverse-engineered the Cryptolocker domain generation algorythm and sinkholed the relevant domains between October 27 and November 1.

During that period, 12016 infected hosts tried to contact the sinkholed domains; the majority of connection attempts came from US-based IP addresses. in fact, judging by the distribution of infected hosts and the payment methods available, it would seem that only systems in the US are targeted, with the rest being collateral damage.

distributie_tari_cryptolocker

The domain generation algorithm is used to avoid the possibility that the network gets shut down by authorities, by generating new command and control subdomains every day. However, once it has been reverse engineered, security researchers can pre-register the relevant domains and count connection attempts.

Cryptolocker servers are changed very often – it is rare that a command and control server remains online for more than a week. During the monitored period, command and control servers were located in Russia, Germany, Kazakhstan and the Ukraine – but this is simply an indication of the controllers’ predilection for constant “server-hopping”.

Almost all the cryptolocker command and control servers also host a public payment service through which victims can purchase decryption keys.

decrypt_cryptolocker

Bitdefender detects and blocks Cryptolocker, as usual. An encryption-blocking tool can also be found here.

Tags:  

Leave a reply


Categories

SATURDAY, AUGUST 24, 2019
WHITE PAPERS

Mission-Critical Broadband – Why Governments Should Partner with Commercial Operators:
Many governments embrace mobile network operator (MNO) networks as ...

ARA at Scale: How to Choose a Solution That Grows With Your Needs:
Application release automation (ARA) tools enable best practices in...

The Multi-Model Database:
Part of the “new normal” where data and cloud applications are ...

Featured

Archives

Latest Comments

Social Networks