The file-encrypting Crowti/CryptoWall ransomware has been detected quite frequently over the past month on computers located in the United States, as a result of multiple new email campaigns spreading the threat.
The malware's modus operandi is now quite well known: after compromising the system, Crowti/CryptoWall begins encrypting data on the hard drive and then shows the victim a message demanding payment to unlock the files.
Telemetry data from Microsoft shows that Crowti activity has spiked since October 13th and peaked at more than 4,000 computers infected on October 17th.
Researchers concluded that most breaches related to this malware last month took place in the United States, where 71% of all infections were recorded.
Other countries that have been affected include Canada, France, Australia, the United Kingdom, Japan, and Spain, but the attacks have had a significantly lower rate, with each region having recorded 6% or fewer incidents related to Crowti.
Crowti has also been found to be contained in other malicious programs, such as Upatre dropper, Zemot, or Zbot.
