{"id":1959,"date":"2013-11-14T22:00:34","date_gmt":"2013-11-15T06:00:34","guid":{"rendered":"https:\/\/alvaka.net\/beta\/?p=1959"},"modified":"2026-08-05T17:43:49","modified_gmt":"2026-08-06T00:43:49","slug":"cryptolocker-critical-security-alert","status":"publish","type":"post","link":"https:\/\/www.alvaka.net\/beta\/cryptolocker-critical-security-alert\/","title":{"rendered":"CryptoLocker Critical Security Alert"},"content":{"rendered":"

Critical Security Alert<\/strong><\/p>\n

Please be advised that Alvaka Networks is notifying it\u2019s clients and partners of a particularly malicious and destructive form of malware or \u201cRansomware\u201d referred to as\u00a0CryptoLocker.\u00a0<\/strong><\/p>\n

Whereas the vast majority of malware is written to stealthily replicate with minimal impact to users,\u00a0CryptoLocker<\/strong>\u00a0is specifically designed to extort money from its victims. \u00a0If a \u00a0\u201cransom\u201d demand is not paid within 96 hours, the users\u2019 files are irrevocably lost.<\/p>\n

When a computer is infected with\u00a0Cryptolocker<\/strong>, its files are encrypted, and there are only two methods to recover the files:<\/p>\n

    \n
  1. Recover the files from a backup system, or<\/li>\n
  2. Pay a ransom ranging from $300 to $2,100 per computer<\/li>\n<\/ol>\n

    When the ransom is paid, the criminals will forward a unique encryption key which can be used to decrypt the files.\u00a0 However, this key is deleted and not available after 96 hours, which effectively renders encrypted files as permanently lost.<\/p>\n

    We must emphasize that, once a system is infected with\u00a0CryptoLocker<\/strong>, there are no other known remediation methods available.\u00a0 Disk recovery services will not work.\u00a0 Attempting to \u201cclean\u201d the infection with anti-virus software will not work, and may actually prevent a ransom-purchased encryption key from functioning.\u00a0 Brute-force decryption is not feasible given the length of the encryption key.\u00a0 Resetting the computer time to an earlier date will not work.<\/p>\n

    Recommendations to prevent CryptoLocker infections<\/strong><\/p>\n

    1. Instruct users not to open attachments from unexpected e-mails.\u00a0 The malicious e-mails appear to be customer-support related messages from trusted names such as Fedex, DHL, UPS, etc. or they appear to be related to wire transfers.\u00a0 These messages are very deceptive and are tricking experienced users that are not usually fooled.<\/p>\n

    2. Configure e-mail systems and spam filters to block e-mails containing .zip and .exe attachments.\u00a0 Note: even if corporate e-mail systems are configured to block these attachments, users can still receive infected e-mail from web-based personal e-mail systems such as Gmail and Hotmail.<\/p>\n

    3. Create Software Restriction Policies that block executable programs from running when they are located in specific paths.\u00a0 For more information, please see these articles from Microsoft.<\/p>\n