When the email is accessed, the potential victim is asked to download and access an attached zip file. The email message pretends to be related to a FAX message that needs your immediate attention. You even receive recommendations for the unlock priceĬTB Locker is delivered through aggressive spam campaigns.How to edit the Locker options, such as the requested price and the language displayed.How to install the bitcoin payment for the server.The following information has been obtained by our security analysts, after they gained access to multiple malware forums from Russia and Ukraine.īy purchasing this dangerous ransomware, one also gains access to the following included services: Since we are dealing with an advanced and well prepared network of malware, which is able to provide such a stable “ service“, we have to point out to the additional benefits one has from joining such a network of e-crime. This means that for an amount of money, even You can enter this Crime as a Service network quite easily! Bitcoin refers to the possibility to pay in Bitcoins, avoiding normal payment systems that can lead back to online criminals įirst, we need to establish the fact that we are dealing with a type of malware specifically developed to be used by online criminals that don’t have (nor need) a very strong technical background.įor this reason, we find a malware with a well-made infrastructure, easy to use and deploy by even less knowledgeable people.Tor comes from the malicious server placed in onion-domain (TOR), which is very difficult to take down.Curve comes from its persistent cryptography based on elliptic curves, which encrypts the affected files with a unique RSA key.The name of the ransomware, CTB, comes from its main advantages: Curve-Tor-Bitcoin.

They were using the Gameover platform to spread and infect systems with CryptoLocker, a dangerous piece of ransomware that encrypts your files and asks a sum of money in exchange for the decryption key.ĬTB Locker is one of the developments of CryptoLocker, the ransomware trojan that spreads mainly through spam and e-mail attachments.

Justice Department in collaboration with the FBI, Europol and some important names in the private sector, like Heimdal, Symantec, Trend Micro and McAfee, took down a large network controlled by hackers in Russia and Ukraine. In June 2014, Operation Tovar, run by the U.S.

Ctb crypto locker