Encrypting ransomware reappeared in September 2013 with a Trojan known as CryptoLocker, which generated a 2048-bit RSA key pair and uploaded in turn to a command-and-control server, and was used to encrypt files using a whitelist of specific file extensions. The malware threatened to delete the private key if a payment of Bitcoin or a pre-paid cash voucher was not made within 3 days of the infection. Due to the extremely large key size it uses, analysts and those affected by the Trojan considered CryptoLocker extremely difficult to repair. Bitcoin is a popular method of payment asked for by ransomware hackers as it can be paid to an anonymous ‘address’ online without leaving a trace or clues as to who the perpetrators are.

The most important thing you can do to make sure you don’t fall prey to ransomware is to be careful with email links. Do not click links or attachments in emails unless you are 100% certain the sender is legitimate. It only takes one person in your organisation to click the link for ransomware to spread to other machines and possibly servers so infecting the whole network. Even visiting the ‘wrong’ type of website can provoke an attack – malware can be added to a machine just through surfing a rogue site. As it spreads across your servers, it can also take out your backups, but we have the skills, expertise and access to the latest decryption tools to get your data back quickly and easily wherever possible to prevent ransomware from taking down your company.

Ransomware is on the rise – there are now more than 50 families of this malware in circulation — and it’s evolving quickly. With each new variant comes better encryption and new features: this is not something you can ignore so talk to your ransomware support Oxford specialists today!