Unlocking CryptoLocker: How infosec bods hunt the fiends behind it

Looks like 2013's nastiest cyber-threat is run from Eastern Europe - or Russia


CryptoLocker, the Bitcoin-hungry ransomware menace that has become 2013’s most infamous malware, was likely created by a single hacker crew in Russia or former Eastern bloc states and is heavily targeting US and UK systems, researchers have exclusively revealed to The Register.

Dell SecureWorks’ Counter Threat Unit (CTU) set up a sinkhole operation not long after the uber ransomware emerged in September, registering multiple domains from a pot of those used by CryptoLocker. Between October 22nd and November 1st, around 31,866 unique IP addresses contacted those CTU sinkhole servers, 22,360 from the US, 1,767 in the UK and 818 in India.

This provides a glimpse into the scourge that CryptoLocker has now become. But Keith Jarvis, a security researcher with Dell SecureWorks’ CTU, estimates the overall number of infected machines is now approximately 250,000.

“The actors infect machines in ‘waves’ so rates wax and wane between zero and around 5,000 a day,” he told El Reg.

Another Russian beastie?

Researchers have been rabidly delving through their CryptoLocker data in an attempt to determine its provenance. It first emerged in September, when early infections were found “disproportionately at financial institutions”, the CTU team said. Various industries have been targeted since then, from the hospitality sector to public utilities.

In the early days, the attackers solely went after businesses, sending out malicious ZIP archives in spam emails, but turned their attention to general PC owners soon enough.

Initial samples were downloaded from a server located in Missouri. Early versions included code to connect to an IP address located in a Phoenix NAP data centre in Arizona. The attackers have been hosting much of their activity on virtual private servers (VPS) located at different “bullet-proof” hosting providers across Russia and former Eastern bloc countries, who are either “indifferent to criminal activity on their networks or are complicit in its execution”, according to the CTU report.

This has led researchers to their suspicion that one gang of crooks based out of Eastern Europe or Russia are to blame.

“The majority of command and control servers hosting the CryptoLocker malware are located in the Russian Federation or the former Eastern bloc states, showing a knowledge of these infrastructure providers, and it is evident from the messages alerting the victims that English is not the CryptoLocker Group’s first language,” Jarvis added.

“This suggests that the threat actors behind CryptoLocker could be located somewhere in the Russian Federation or the former Eastern bloc states. Additionally, we have seen many hacker scams come out of this area of the world and target mainly English-speakers in the US and UK,” continued Jarvis. “We think it is wholly controlled and operated by a single crew, and not bought and sold on the underground.”

They’re using methods typical amongst Russian crooks, distributing it with the peer-to-peer (P2P) Gameover Zeus malware, in some cases via the Cutwail spam botnet or the Magnitude exploit kit.

Cryptolocker: In a class of its own

The reason why researchers are in such a spin about CryptoLocker is simple: it’s an advanced piece of ransomware, especially compared to the usual tripe that tells the user they’ve been caught doing nasty things and need to pay a fine. CryptoLocker follows through with its promise of encrypting users’ files, unlike other ransomware, and it does so with some finesse.

“This isn’t the first malware that destroys files, but it’s certainly in its own class,” Jarvis added.

Using the Microsoft CryptoAPI, Cryptolocker encrypts each file with a unique AES key, which is then encrypted with the RSA public key received from the crooks’ server. The malware has that public key, along with a small amount of metadata and the encrypted file contents, written back to disk, replacing the original files.

The only way to decrypt them is with the RSA private key held by the criminals, which can purportedly be acquired by handing over money, normally around 0.3 BTC. The CryptoLocker overlords also accept transfers over MoneyPak, another money transfer system.

Whilst some had suggested that payments did not result in decryption, victims have reported regaining access after coughing up. Sometimes, however, it takes weeks for the files to be unlocked. The crooks even created a “CryptoLocker Decryption Service” (see below) in early November, which gave people a chance to decrypt their docs even if they had not handed over the money before CryptoLocker’s ticking clock of doom hit 00:00. Early versions of this service charged 10 BTC, but then the value of a single bitcoin hit the $1000 mark, so the cost had to come down.

The masterminds have tried to avoid white hats by shifting around their C&C infrastructure. They’ve been using a domain generation algorithm (DGA) to create 1,000 potential command and control domain addresses per day, to be used alongside static servers for their villainous campaign. This dynamism appears to be working. Dell SecureWorks is now struggling to get meaningful stats from its sinkhole operation.

Cryptolocker won’t be disappearing in 2014. Indeed, it looks set to grow only larger – thanks to the wherewithal and technical nous of the gang behind it. ®

Similar topics

Broader topics


Other stories you might like

  • Don't hate on cryptomining, hate the power stations, say Bitcoin super-fans
    We're not the ones telling them to burn fossil fuels, top names write in response to probe request

    Big names in Bitcoin have defended cryptocurrency mining, issuing a jointly signed letter hitting back at US lawmakers who last month urged a government watchdog to probe the practice.

    Twitter founder and Bitcoin champion Jack Dorsey, the CEO of Bitcoin-collecting MicroStrategy Michael Saylor, and others on Monday signed the letter [PDF] that is a point-by-point rebuttal to a memo [PDF] sent last month to America's Environmental Protection Agency (EPA) by Representative Jared Huffman (D-CA) and a couple dozen other Democrats.

    In that first letter, Huffman and pals asked the EPA to probe proof-of-work cryptocurrency mining facilities to ensure they're following US laws such as the Clean Air Act and Clean Water Act, and not having an outsized effect on climate change. Proof-of-work cryptocurrencies include Bitcoin, Ethereum, and Monero. Ethereum, for one, is planning to move to fully proof-of-stake approach, which is more energy efficient.

    Continue reading
  • Wiki community votes to stop accepting cryptocurrency donations
    Cryptocurrencies make up less than 1% of wiki donations, but as member points out, that $130k could pay a salary

    The wiki community held a vote as to whether the Wikimedia Foundation should continue to accept cryptocurrency donations, the result of which was a resounding "no".

    The proposal was made by Wikipedia administrator, checkuser and oversighter GorillaWarfare based on three points: it could be seen as an endorsement of cryptocurrency by the organization; the tech is not environmentally sustainable; and, last of all, accepting crypto could damage the reputation of the foundation.

    The Wikimedia Foundation currently accepts donations in Bitcoin, Bitcoin Cash and Ethereum, as well as traditional payment types. According to the community, crypto is one of the foundation's smallest revenue channels, making up a mere .08 percent of 2021 revenue, equating to $130,100. Total revenue for 2021 was around $162 million.

    Continue reading
  • Crypto inferno: Intel's Bitcoin-mining Blockscale ASIC to arrive in Q3
    Gelsinger's firm drops details on crypto chip – including hash rate of up to 580GHps

    Intel has disclosed more details of its Blockscale ASIC, the firm's entry into the realm of cryptocurrency mining with a dedicated chip built to provide users with energy-efficient hashing for proof-of-work consensus networks.

    As previously revealed, the chip now identified as the Intel Blockscale ASIC is designed to provide hardware acceleration for SHA-256 (Secure Hash Algorithm-256) processing for blockchain proof-of-work applications. It will start shipping in the third quarter of 2022.

    Intel has now claimed that its Blockscale ASIC has a hash rate of up to 580GHps, or giga hashes per second, and can support up to 256 integrated circuits per chain. The latter means that a customer could theoretically build and operate a mining system comprising 256 of the Blockscale chips, which would be capable of over 148THps, or tera hashes per second.

    Continue reading
  • Europe advances crypto-coin regulation – without potential ban on Bitcoin
    Vote held after red-tape targeting proof-of-work assets removed

    Europe's lawmakers this week moved ahead with their proposed cryptocurrency regulations, having ditched a rule that might have banned financial services from dealing in Bitcoin and Ethereum.

    The European Union is considering ways to regulate digital coins, particularly to stamp out money laundering, and as such in 2020 drew up a draft framework dubbed the Markets in Crypto Assets (MiCA) to achieve this. During the development of this red tape, an amendment was proposed that, depending on its interpretation, could have made it illegal for app and web services to handle transactions involving proof-of-work coins, such as Bitcoin and Ethereum.

    Proof-of-work algorithms underpin these cryptocurrencies, how they are mined, and how transactions are confirmed by the network. These algorithms have been criticized for being computationally intensive and consuming large amounts of energy, prompting some lawmakers to propose restrictions. Under the European Green Deal, member states are trying to slash greenhouse gas emissions, and are heavily scrutinizing activities like running proof-of-work algorithms.

    Continue reading

Biting the hand that feeds IT © 1998–2022