

The consensus on the forum was decidedly skeptical. Even at the time, there were warning signs. The ransomware service I ended up using was the first one I found, a few minutes after logging in to the first hacker chatroom I tried. It’s widely suspected to have been a Russian cyberweapon built neither to steal information nor hold it for ransom, but simply to destroy it. And some attacks turn out not to be ransomware at all: NotPetya, which caused billions of dollars in damages worldwide in 2017, lacked any means to reverse its encryption. (Some ensure the material is there by first downloading actual child pornography.) Some attackers start by luring victims to a compromised website where a software “exploit kit” can slip the malware through their browser’s vulnerabilities. But there are others: Some attacks pretend to be from a law enforcement agency that’s locked down your machine because of illicit material found there.

And the CryptoLocker recipe-phishing, strong encryption, Bitcoin-remains the dominant template for ransomware today. Three Italian computer science researchers traced 771 payments flowing into Bitcoin wallets connected to the ransomware variant, totaling 1226 Bitcoin ($1.1 million at the time), likely a very conservative figure.
