Cryptowall 3.0 ransomware loot goes into one group's pocket! The latest version alone has made the attackers $325 million richer!
Only one cybercriminal group is reportedly collecting the loot of Cryptowall 3.0, a malicious program that infects computers, encrypts files and demands ransom, according to new research released this week. The findings come from the Cyber Threat Alliance (CTA), a group formed last year to study urgent threats, whose members include major security companies such as Intel Security, Palo Alto Networks, Fortinet and Symantec.
Cryptowall is part of a vast family of ransomware that has become a growing threat to both businesses and consumers. If a computer is infected, its files are rendered unusable by strong encryption.
There is little that victims can do. The best defense is to ensure that they have backed up files and that the backups cannot be accessed by the attackers. Otherwise, the only option is to accept the loss of their files or pay the ransom, which can range from $500 to $10,000.
The CTA studied Cryptowall 3.0, the latest version of the malware, which appeared earlier this year. Victims are required to pay in bitcoin and are sent an address for a bitcoin wallet that is of course controlled by the attackers.
Since bitcoin transfers are publicly recorded on what's called a blockchain, they can be analyzed. But to make life harder for security researchers, they assign a different bitcoin wallet address to each victim, and the 'junk' is then distributed to many other wallets that in some cases cannot be traced because their tracks are lost.
Attacks directed at victims' computers come in waves, and cyber criminals track these waves by giving them different IDs, in a similar way that digital marketing campaigns are monitored.
A campaign called “crypt100” has infected more than 15,000 computers worldwide, generating at least $5 million in revenue. In total, CTA estimates that Cryptowall 3.0 may have generated profits in excess of $325 million!
