The Latest in IT Security

Trojan.Ransomgerpo Criminal Arrested


Spanish police have reported the arrest of an individual involved with a particular strain of police Ransomware known as Ransom.EY, detected by Symantec as Trojan.Ransomgerpo.

This variant is one of the earliest active police Ransomware families, which Symantec has been tracking since at least July, 2011. The Trojan was distributed using drive by download techniques, in conjunction with the Black Hole exploit kit. Early versions of the locking screen were quite primitive but quickly evolved as the author obviously stole design ideas from other Ransomware gangs as shown in Figure 1.

Figure 1. Early design of Trojan.Ransomgerpo and a more recent, sophisticated style. (The most recent image was kindly provided by Kafeine from

The Trojan, as Figure 1 implies, initially focused on German individuals, but in later months began to target other countries, primarily the USA. The total set of targeted countries is shown in Figure 2 and a graph of the Trojan’s activity is shown in Figure 3.

Figure 2. Trojan.Ransomgerpo infection map

Figure 3. Infection activity over time

The attackers clearly operated in bursts, distributing the Trojan irregularly over time.

Symantec, as well as several other security companies and researchers, contributed information to law enforcement regarding this particular Trojan and are delighted that an arrest has been made. Symantec will continue to cooperate with law enforcement to ensure that cyber criminals are brought to justice.

For more information on Police Ransomware, see our research paper which investigates over sixteen different Ransomlock families.

Leave a reply


MONDAY, JULY 15, 2024

Mission-Critical Broadband – Why Governments Should Partner with Commercial Operators:
Many governments embrace mobile network operator (MNO) networks as ...

ARA at Scale: How to Choose a Solution That Grows With Your Needs:
Application release automation (ARA) tools enable best practices in...

The Multi-Model Database:
Part of the “new normal” where data and cloud applications are ...



Latest Comments