{ "family": "cryptolocker", "sample_count": 10, "category": "ransomware", "description": "CryptoLocker is the historic archetype of modern asymmetric ransomware, first discovered in September 2013. Engineered and operated under the criminal syndicate led by Russian national Evgeniy Mikhailovich Bogachev (known online as 'lucky12345' and 'slavik'), CryptoLocker pioneered the ruthless pairing of AES-256 local file encryption with an asymmetric RSA-2048 public-key infrastructure, ensuring that victim files could not be decrypted without the private key held exclusively on attacker-controlled command servers.\n\nCryptoLocker was primarily distributed via Bogachev's GameOver Zeus botnet and high-volume phishing emails carrying malicious attachments. In May and June 2014, an unprecedented multinational law enforcement coalition led by the US Department of Justice, the FBI, Europol EC3, the UK National Crime Agency (NCA), and police agencies across 10 nations executed 'Operation Tovar'. The operation seized the central command-and-control servers, dismantled GameOver Zeus, and recovered the master database of private decryption keys. The US DOJ indicted Bogachev in the Western District of Pennsylvania, and the FBI placed him on the Cyber's Most Wanted list with a record $3 million reward. Following the takedown, security firms FireEye and Fox-IT launched the free 'DecryptCryptoLocker' portal, enabling hundreds of thousands of victims worldwide to recover their data without paying ransom.", "cta": "Published by the SystemHelpdesk team.", "aliases": [ "CryptoLocker", "Trojan.CryptoLocker", "Win32/CryptoLocker", "Ransom.CryptoLocker" ], "enrichment_level": "curated_sourced", "faq": [ { "@type": "Question", "name": "What was CryptoLocker?", "acceptedAnswer": { "@type": "Answer", "text": "CryptoLocker was the landmark asymmetric ransomware discovered in 2013 that encrypted victim files with AES-256 and locked the decryption key using RSA-2048." } }, { "@type": "Question", "name": "Who operated CryptoLocker and what was Operation Tovar?", "acceptedAnswer": { "@type": "Answer", "text": "CryptoLocker was operated by Russian cybercriminal Evgeniy Bogachev. In May 2014, the FBI and international police launched Operation Tovar, seizing the botnet servers and recovering master keys." } }, { "@type": "Question", "name": "How was CryptoLocker delivered to victim machines?", "acceptedAnswer": { "@type": "Answer", "text": "CryptoLocker was distributed as a secondary payload through the GameOver Zeus botnet and mass phishing emails masquerading as parcel tracking or payroll notices." } }, { "@type": "Question", "name": "Can CryptoLocker encrypted files be decrypted without paying?", "acceptedAnswer": { "@type": "Answer", "text": "Yes, because law enforcement seized the master private keys during Operation Tovar, security researchers built free public decryption utilities that recover files infected by authentic CryptoLocker." } }, { "@type": "Question", "name": "What impact did CryptoLocker have on the cybersecurity industry?", "acceptedAnswer": { "@type": "Answer", "text": "CryptoLocker demonstrated that asymmetric cryptography could be weaponized at scale, triggering the modern multi-billion dollar ransomware crisis and inspiring hundreds of successor variants." } } ], "faq_count": 5, "mitre_attack": [ "T1486", "T1071.001", "T1568.002", "T1547.001", "T1027", "T1082" ], "cisa_advisory": null, "last_updated": "2026-06-09", "sources": [ { "name": "US DOJ Press Release - Global Effort Disrupts GameOver Zeus and CryptoLocker", "url": "https://www.justice.gov/opa/pr/us-leads-global-effort-disrupt-gameover-zeus-botnet-and-cryptolocker-ransomware" }, { "name": "FBI Most Wanted - Evgeniy Mikhailovich Bogachev", "url": "https://www.fbi.gov/wanted/cyber/evgeniy-mikhailovich-bogachev" }, { "name": "MITRE ATT&CK - CryptoLocker", "url": "https://attack.mitre.org/" } ], "target_industries": [ "Healthcare", "Critical Infrastructure", "Enterprise" ], "motivation": "Financial Extortion", "threat_actors": [ "Unknown / Cybercriminal" ], "target_geographies": [ "Global" ], "attack_stage": [ "defense_evasion", "impact" ], "ecosystem": [ "windows_pe" ], "is_emerging": false, "first_seen": 2013, "lineage": { "derived_from": [ "gameover zeus" ], "variants": [ "cryptolocker original (2013)", "cryptolocker v2 clone", "operation tovar master key recovery" ] }, "attribution": [ { "actor": "Evgeniy Mikhailovich Bogachev ('slavik') / Operation Tovar Coalition (DOJ / FBI / Europol)", "confidence": "high", "basis": "Federal indictment unsealed in the Western District of Pennsylvania against Evgeniy Bogachev in June 2014 following Operation Tovar, which dismantled the GameOver Zeus and CryptoLocker command infrastructure and recovered master decryption keys.", "source": "https://www.justice.gov/opa/pr/us-leads-global-effort-disrupt-gameover-zeus-botnet-and-cryptolocker-ransomware" } ], "exploited_cves": [ "CVE-2013-3906" ], "c2_profile": { "protocols": [ "HTTP", "HTTPS", "Algorithmic DGA (1,000 domains/day)" ], "ports": [ 80, 443 ], "infrastructure": "Decentralized command servers utilizing a daily domain generation algorithm querying 1,000 domains across multiple top-level domains (.com, .net, .biz, .ru, .info) to upload symmetric AES keys and retrieve the victim's unique RSA-2048 public key." }, "iocs": { "file_hashes": [ "2efb6d17b5e4c6981cfda552553ca4be969796ff07a835a96aef71a2ec703ce5", "b1b4c330f89fa6d165f973e20e8b22a08846c4f09a5b3a8634860b0ec89c565d" ], "delivery": [ "GameOver Zeus peer-to-peer botnet secondary payload drops", "Phishing campaigns spoofing FedEx, UPS, or banking notifications containing weaponized ZIP files with double-extension executables" ], "persistence": [ "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run entry pointing to staged executable in %APPDATA%", "Storage of encryption keys and list of encrypted file paths in registry subkeys under HKCU\\Software\\CryptoLocker" ] }, "mitre_attack_detail": [ { "id": "T1486", "name": "Data Encrypted for Impact", "tactic": "Impact" }, { "id": "T1071.001", "name": "Application Layer Protocol: Web Protocols (C2 Communication)", "tactic": "Command and Control" }, { "id": "T1568.002", "name": "Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting)", "tactic": "Command and Control" }, { "id": "T1547.001", "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder", "tactic": "Persistence" }, { "id": "T1027", "name": "Obfuscated Files or Information", "tactic": "Defense Evasion" }, { "id": "T1082", "name": "System Information Discovery", "tactic": "Discovery" } ], "containment_steps": [ "Immediately isolate affected host(s) from the internal network (disconnect physical Ethernet and disable Wi-Fi/Bluetooth) to prevent Cryptolocker from spreading laterally or encrypting network-attached storage (NAS) and shared SMB volumes.", "Preserve volatile system memory (RAM capture) on a representative endpoint before attempting a reboot or power-down, as Cryptolocker symmetric encryption keys or uncompiled payload components may still reside in memory.", "Audit process execution logs and terminate active scripting interpreters (e.g. PowerShell, CMD, WScript) or commands executing 'vssadmin.exe delete shadows' or 'wbadmin' used by Cryptolocker to inhibit recovery.", "Investigate the initial compromise vector (such as exposed RDP instances, spearphishing attachments, or vulnerable edge gateways) and enforce an immediate credential reset for all compromised Active Directory accounts.", "Restore critical assets and databases exclusively from verified, air-gapped, or immutable offline backups once the Cryptolocker binary and related persistence hooks are eradicated." ], "what_to_avoid": [ "Do not restart or power cycle infected systems prematurely; doing so destroys volatile RAM encryption keys and may trigger bootloader locking logic embedded in Cryptolocker.", "Avoid negotiating or paying the extortion demand without prior forensic evaluation and consultation with incident response specialists, as payment does not guarantee data recovery.", "Do not connect clean backup drives or external storage to the affected network until Cryptolocker eradication is completely verified." ], "target_platforms": [ "Windows 11", "Windows 10", "Windows Server 2022", "Windows Server 2019" ] }