Kaspersky Lab and Dutch Police End the Nightmare for 14,031 Victims of CoinVault and Bitcryptor Ransomware
Kaspersky Lab has added 14,031 additional decryption keys to the online repository noransom.kaspersky.com, giving all users who have fallen victim to the CoinVault and Bitcrypto ransomware programsthe opportunity to recover their encrypted data without having to pay a single bitcoin as a ransom to the criminals.
The keys and the decryption application created by Kaspersky Lab are available for free at https://noransom.kaspersky.com.
In total, since April 2015, 14,755 keys have been made available so that victims can unlock their files using the decryption application created by Kaspersky Lab experts. The Dutch National Prosecutor’s Office has taken possession of the decryption keys from the CoinVault Command & Control servers. In September, the Dutch Police arrested two men in the Netherlands on suspicion of involvement in the ransomware . Following these arrests – and given that the last set of keys has now been retrieved from the server – we can say that the time has come to close the case regarding the CoinVault attacks.
The cybercriminals behind CoinVault attempted to infect tens of thousands of computers around the world, with the majority of victims located in the Netherlands, Germany, the US, France and the UK. Users from a total of 108 countries were affected. The criminals managed to “lock” at least 1,500 Windows computers, demanding bitcoins from users to decrypt their files.
Kaspersky Lab discovered the first version of CoinVault in May 2014 and later contributed to the in-depth analysis of all relevant malware samples in an investigation conducted by the Dutch National Police Technology Crime Unit (NHTCU) and the Dutch National Prosecutor’s Office. During their joint investigation, the two authorities took possession of databases from CoinVault’s Command & Control servers. These servers contained Initialization Vectors (IVS), keys and private Bitcoin wallets. Based on these, Kaspersky Lab and the Dutch National Police Technology Crime Unit were able to create the dedicated online “repository” of decryption keys.
“The CoinVault story is coming to an end, as all victims are now able to recover their files, and the cybercriminals have been arrested, thanks to the cooperation of the Dutch Police, Kaspersky Lab and Panda Security. What makes the CoinVault investigation unique is the fact that we were able to recover all the keys. Through hard work, we managed to completely disrupt the working model of this criminal group,” commented Jornt van der Wiel, Researcher at Kaspersky Lab’s Global Research and Analysis Team.
About Kaspersky Lab
Kaspersky Lab is one of the fastest growing cybersecurity companies in the world and the largest privately held company in the industry. The company is among the top four providers of security solutions for end-users in the world (according to IDC data for 2014). Since 1997, Kaspersky Lab has been innovating in the field of cybersecurity, offering cost-effective solutions to protect consumers, small and medium-sized enterprises and large enterprises. Kaspersky Lab is a global company, with operations spanning 200 countries and regions around the world, providing online security to over 400 million users. For more information, visit: www.kaspersky.com.
