CryptoLocker — file‑encrypting ransomware

Key characteristics

• Encryption: CryptoLocker used asymmetric (public‑key) cryptography, typically RSA, so the private key needed to reverse the encryption was not present on the victim’s machine and was controlled by the operators. For technical background see technical analysis.
• Distribution: Early campaigns spread via email attachments and malicious links embedded in messages; in other cases it was delivered through compromised machines and botnets. For distribution methods see email vector and botnet reports.
• Targets: Rather than system files, CryptoLocker focused on user data — spreadsheets, photos, documents, archives and similar files — including files on connected network shares and removable media when accessible.
• Ransom demands: Operators typically demanded payment in cryptocurrencies such as Bitcoin, and displayed a graphical ransom note with instructions on how to pay. Example ransom message summaries are available via sample notices and payment background via Bitcoin information.

History and disruption

Reports place the first widespread CryptoLocker campaigns in September 2013. The malware attracted widespread attention because of the strength of its encryption and its use of public‑key cryptography, which made recovery difficult without backups or the attackers’ private key. Law‑enforcement agencies and security researchers later coordinated actions to disrupt parts of the infrastructure behind major campaigns; in some cases this led to available decryptors or reductions in activity. For detailed timeline material see an early overview report and follow‑up analyses.

Impact and response

CryptoLocker and similar ransomware had significant practical and financial impacts on individuals, businesses and public institutions. Authorities and security professionals generally advise against paying ransoms because payment does not guarantee recovery, encourages further attacks and may have legal or policy implications; official guidance and timelines of deadlines are discussed in public advisories such as deadline guidance. Prevention measures include offline and versioned backups, up‑to‑date endpoint defenses, filtering of suspicious email attachments and restricting access to network shares. Some victims were later able to recover files using decryption tools released after takedown operations; archived decryptors and remediation resources are referenced at recovery resources.

Notable facts and distinctions

CryptoLocker helped popularize the modern ransomware model of encrypting user data and demanding cryptocurrency payment. It is distinct from screen‑locker malware that simply blocks access to the system; CryptoLocker’s damage derives from strong cryptographic locking of files. Its prominence prompted improvements in incident response, greater emphasis on backups, and international cooperation to disrupt ransomware ecosystems.