साइबर सुरक्षा के बुनियादी उपाय
साइबर सुरक्षा जागरूकता का परिचय - एसएसएल ड्रैगन - SSL Dragon
इस डिजिटल फ्रंटियर को सुरक्षित रूप से नेविगेट करने के लिए, यह जरूरी है कि हम सामूहिक रूप से साइबर सुरक्षा जोखिमों की अपनी समझ को मजबूत करें और उन्हें कम करने के लिए सक्रिय उपाय अपनाएं। यह लेख साइबर ...
क्रिप्टोलॉकर
अब तक के सबसे लाभदायक रैंसमवेयर में से एक <anchor>क्रिप्टोलॉकर</anchor> था। सितंबर और दिसंबर 2013 के बीच, इसने 250,000 से अधिक प्रणालियों को संक्रमित किया और अपने रचनाकारों को $ 3 मिलियन से अधिक अर्जित किया।
CryptoLocker - Wikipedia
CryptoLocker - Wikipedia[Jump to content](#bodyContent)

Main menu

Main menu

move to sidebarhide

Navigation


- [Main page](/wiki/Main_Page "Visit the main page [z]")
- [Contents](/wiki/Wikipedia:Contents "Guides to browsing Wikipedia")
- [Current events](/wiki/Portal:Current_events "Articles related to current events")
- [Random article](/wiki/Special:Random "Visit a randomly selected article [x]")
- [About Wikipedia](/wiki/Wikipedia:About "Learn about Wikipedia and how it works")
- [Contact us](//en.wikipedia.org/wiki/Wikipedia:Contact_us "How to contact Wikipedia")
- [Donate](https://donate.wikimedia.org/wiki/Special:FundraiserRedirector?utm_source=donate&utm_medium=sidebar&utm_campaign=C13_en.wikipedia.org&uselang=en "Support us by donating to the Wikimedia Foundation")

Contribute


- [Help](/wiki/Help:Contents "Guidance on how to use and edit Wikipedia")
- [Learn to edit](/wiki/Help:Introduction "Learn how to edit Wikipedia")
- [Community portal](/wiki/Wikipedia:Community_portal "The hub for editors")
- [Recent changes](/wiki/Special:RecentChanges "A list of recent changes to Wikipedia [r]")
- [Upload file](/wiki/Wikipedia:File_upload_wizard "Add images or other media for use on Wikipedia")

[![](/static/images/icons/wikipedia.png)![Wikipedia](/static/images/mobile/copyright/wikipedia-wordmark-en.svg)![The Free Encyclopedia](/static/images/mobile/copyright/wikipedia-tagline-en.svg)](/wiki/Main_Page)

[Search](/wiki/Special:Search "Search Wikipedia [f]")

Search

Appearance

- [Create account](/w/index.php?title=Special:CreateAccount&returnto=CryptoLocker "You are encouraged to create an account and log in; however, it is not mandatory")
- [Log in](/w/index.php?title=Special:UserLogin&returnto=CryptoLocker "You're encouraged to log in; however, it's not mandatory. [o]")

Personal tools

- [Create account](/w/index.php?title=Special:CreateAccount&returnto=CryptoLocker "You are encouraged to create an account and log in; however, it is not mandatory")
- [Log in](/w/index.php?title=Special:UserLogin&returnto=CryptoLocker "You're encouraged to log in; however, it's not mandatory. [o]")

Pages for logged out editors [learn more](/wiki/Help:Introduction)

- [Contributions](/wiki/Special:MyContributions "A list of edits made from this IP address [y]")
- [Talk](/wiki/Special:MyTalk "Discussion about edits from this IP address [n]")

## Contents

move to sidebarhide

- (Top)

- [1Operation](#Operation)Toggle Operation subsection  - [1.1Takedown and recovery of files](#Takedown_and_recovery_of_files)
- [2Mitigation](#Mitigation)
- [3Money paid](#Money_paid)
- [4Clones](#Clones)
- [5See also](#See_also)
- [6References](#References)

Toggle the table of contents

# CryptoLocker

21 languages

- [Azərbaycanca](https://az.wikipedia.org/wiki/CryptoLocker "CryptoLocker – Azerbaijani")
- [Català](https://ca.wikipedia.org/wiki/CryptoLocker "CryptoLocker – Catalan")
- [Čeština](https://cs.wikipedia.org/wiki/CryptoLocker "CryptoLocker – Czech")
- [Eesti](https://et.wikipedia.org/wiki/CryptoLocker "CryptoLocker – Estonian")
- [Español](https://es.wikipedia.org/wiki/CryptoLocker "CryptoLocker – Spanish")
- [فارسی](https://fa.wikipedia.org/wiki/%DA%A9%D8%B1%DB%8C%D9%BE%D8%AA%D9%88_%D9%84%D8%A7%DA%A9%D8%B1 "کریپتو لاکر – Persian")
- [Français](https://fr.wikipedia.org/wiki/CryptoLocker "CryptoLocker – French")
- [한국어](https://ko.wikipedia.org/wiki/%ED%81%AC%EB%A6%BD%ED%86%A0%EB%9D%BD%EC%BB%A4 "크립토락커 – Korean")
- [Bahasa Indonesia](https://id.wikipedia.org/wiki/CryptoLocker "CryptoLocker – Indonesian")
- [Italiano](https://it.wikipedia.org/wiki/CryptoLocker "CryptoLocker – Italian")
- [עברית](https://he.wikipedia.org/wiki/%D7%A7%D7%A8%D7%99%D7%A4%D7%98%D7%95%D7%9C%D7%95%D7%A7%D7%A8 "קריפטולוקר – Hebrew")
- [Lombard](https://lmo.wikipedia.org/wiki/CryptoLocker "CryptoLocker – Lombard")
- [Nederlands](https://nl.wikipedia.org/wiki/Cryptoware "Cryptoware – Dutch")
- [日本語](https://ja.wikipedia.org/wiki/CryptoLocker "CryptoLocker – Japanese")
- [Русский](https://ru.wikipedia.org/wiki/CryptoLocker "CryptoLocker – Russian")
- [Simple English](https://simple.wikipedia.org/wiki/CryptoLocker "CryptoLocker – Simple English")
- [Slovenščina](https://sl.wikipedia.org/wiki/CryptoLocker "CryptoLocker – Slovenian")
- [Suomi](https://fi.wikipedia.org/wiki/Cryptolocker "Cryptolocker – Finnish")
- [Türkçe](https://tr.wikipedia.org/wiki/CryptoLocker "CryptoLocker – Turkish")
- [Tiếng Việt](https://vi.wikipedia.org/wiki/CryptoLocker "CryptoLocker – Vietnamese")
- [中文](https://zh.wikipedia.org/wiki/CryptoLocker "CryptoLocker – Chinese")

[Edit links](https://www.wikidata.org/wiki/Special:EntityPage/Q15122248#sitelinks-wikipedia "Edit interlanguage links")

- [Article](/wiki/CryptoLocker "View the content page [c]")
- [Talk](/wiki/Talk:CryptoLocker "Discuss improvements to the content page [t]")

English

- [Read](/wiki/CryptoLocker)
- [Edit](/w/index.php?title=CryptoLocker&action=edit "Edit this page [e]")
- [View history](/w/index.php?title=CryptoLocker&action=history "Past revisions of this page [h]")

Tools

Tools

move to sidebarhide

Actions


- [Read](/wiki/CryptoLocker)
- [Edit](/w/index.php?title=CryptoLocker&action=edit "Edit this page [e]")
- [View history](/w/index.php?title=CryptoLocker&action=history)

General


- [What links here](/wiki/Special:WhatLinksHere/CryptoLocker "List of all English Wikipedia pages containing links to this page [j]")
- [Related changes](/wiki/Special:RecentChangesLinked/CryptoLocker "Recent changes in pages linked from this page [k]")
- [Upload file](/wiki/Wikipedia:File_Upload_Wizard "Upload files [u]")
- [Special pages](/wiki/Special:SpecialPages "A list of all special pages [q]")
- [Permanent link](/w/index.php?title=CryptoLocker&oldid=1232783766 "Permanent link to this revision of this page")
- [Page information](/w/index.php?title=CryptoLocker&action=info "More information about this page")
- [Cite this page](/w/index.php?title=Special:CiteThisPage&page=CryptoLocker&id=1232783766&wpFormIdentifier=titleform "Information on how to cite this page")
- [Get shortened URL](/w/index.php?title=Special:UrlShortener&url=https%3A%2F%2Fen.wikipedia.org%2Fwiki%2FCryptoLocker)
- [Download QR code](/w/index.php?title=Special:QrCode&url=https%3A%2F%2Fen.wikipedia.org%2Fwiki%2FCryptoLocker)
- [Wikidata item](https://www.wikidata.org/wiki/Special:EntityPage/Q15122248 "Structured data on this page hosted by Wikidata [g]")

Print/export


- [Download as PDF](/w/index.php?title=Special:DownloadAsPdf&page=CryptoLocker&action=show-download-screen "Download this page as a PDF file")
- [Printable version](/w/index.php?title=CryptoLocker&printable=yes "Printable version of this page [p]")

In other projects


Appearance

move to sidebarhide

From Wikipedia, the free encyclopedia

Malware

This article is about specific ransomware software called CryptoLocker. For other similar software, some using the CryptoLocker name, see [Ransomware § Encrypting ransomware](/wiki/Ransomware#Encrypting_ransomware "Ransomware").

CryptoLockerType[Ransomware](/wiki/Ransomware "Ransomware")Subtype[Cryptovirus](/wiki/Cryptovirology "Cryptovirology")Classification[Trojan horse](/wiki/Trojan_horse_(computing) "Trojan horse (computing)")Isolation date2 June 2014Technical detailsPlatform[Windows](/wiki/Microsoft_Windows "Microsoft Windows")

The **CryptoLocker ransomware attack** was a [cyberattack](/wiki/Cyberattack "Cyberattack") using the _CryptoLocker_ [ransomware](/wiki/Ransomware "Ransomware") that occurred from 5 September 2013 to late May 2014. The attack utilized a [trojan](/wiki/Trojan_horse_(computing) "Trojan horse (computing)") that targeted [computers](/wiki/Computer "Computer") running on [Microsoft Windows](/wiki/Microsoft_Windows "Microsoft Windows"),[\[1\]](#cite_note-ars-cryptolocker-1) and was believed to have first been posted to the [Internet](/wiki/Internet "Internet") on 5 September 2013.[\[2\]](#cite_note-bbc241213-2) It propagated via infected email attachments, and via an existing [Gameover ZeuS](/wiki/Gameover_ZeuS "Gameover ZeuS") [botnet](/wiki/Botnet "Botnet").[\[3\]](#cite_note-3) When activated, the malware [encrypted](/wiki/Encryption "Encryption") certain types of files stored on local and mounted network drives using RSA [public-key cryptography](/wiki/Public-key_cryptography "Public-key cryptography"), with the private key stored only on the malware's control servers. The malware then displayed a message which offered to decrypt the data if a payment (through either [bitcoin](/wiki/Bitcoin "Bitcoin") or a pre-paid cash voucher) was made by a stated deadline, and it threatened to delete the private key if the deadline passes. If the deadline was not met, the malware offered to decrypt data via an online service provided by the malware's operators, for a significantly higher price in bitcoin. There was no guarantee that payment would release the encrypted content.

Although CryptoLocker itself was easily removed, the affected files remained encrypted in a way which researchers considered unfeasible to break. Many said that the [ransom](/wiki/Ransom "Ransom") should not be paid, but did not offer any way to recover files; others said that paying the ransom was the only way to recover files that had not been [backed up](/wiki/Backup "Backup"). Some victims claimed that paying the ransom did not always lead to the files being decrypted.

CryptoLocker was isolated in late May 2014 via [Operation Tovar](/wiki/Operation_Tovar "Operation Tovar"), which took down the [Gameover ZeuS](/wiki/Gameover_ZeuS "Gameover ZeuS") [botnet](/wiki/Botnet "Botnet") that had been used to distribute the malware.[\[4\]](#cite_note-4) During the operation, a security firm involved in the process obtained the database of private keys used by CryptoLocker, which was in turn used to build an online tool for recovering the keys and files without paying the ransom. It is believed that the operators of CryptoLocker successfully extorted a total of around $3 million from victims of the trojan. Other instances of encryption-based ransomware that have followed have used the "CryptoLocker" name (or variations), but are otherwise unrelated.

## Operation

\[ [edit](/w/index.php?title=CryptoLocker&action=edit&section=1 "Edit section: Operation")\]

CryptoLocker typically propagated as an [attachment](/wiki/Email_attachment "Email attachment") to a seemingly innocuous [e-mail](/wiki/Email "Email") message, which appears to have been sent by a legitimate company.[\[5\]](#cite_note-securityweek131119-5) A [ZIP file](/wiki/Zip_(file_format) "Zip (file format)") attached to an email message contains an executable file with the filename and the icon disguised as a [PDF](/wiki/Portable_Document_Format "Portable Document Format") file, taking advantage of Windows' default behaviour of hiding the [extension](/wiki/Filename_extension "Filename extension") from file names to disguise the real .EXE extension. CryptoLocker was also propagated using the [Gameover ZeuS](/wiki/Gameover_ZeuS "Gameover ZeuS") trojan and botnet.[\[6\]](#cite_note-krebs2014-6)[\[7\]](#cite_note-details-7)[\[8\]](#cite_note-cw-cryptolocker-8)

When first run, the [payload](/wiki/Payload_(computing) "Payload (computing)") installs itself in the [user profile](/wiki/User_profiles_in_Microsoft_Windows "User profiles in Microsoft Windows") folder, and adds a key to the [registry](/wiki/Windows_Registry "Windows Registry") that causes it to run on startup. It then attempts to contact one of several designated command and control servers; once connected, the server generates a [2048-bit](/wiki/RSA_numbers#RSA-2048 "RSA numbers") [RSA](/wiki/RSA_(cryptosystem) "RSA (cryptosystem)") key pair, and sends the [public key](/wiki/Public-key_cryptography "Public-key cryptography") back to the infected computer.[\[1\]](#cite_note-ars-cryptolocker-1)[\[7\]](#cite_note-details-7) The server may be a local [proxy](/wiki/Proxy_server "Proxy server") and go through others, frequently relocated in different countries to make tracing them more difficult.[\[9\]](#cite_note-sophos-cryptolocker-9)[\[10\]](#cite_note-guardian-cryptolocker-10)

The payload then encrypts files across local hard drives and [mapped network drives](/wiki/Drive_mapping "Drive mapping") with the public key, and logs each file encrypted to a registry key. The process only encrypts data files with certain [extensions](/wiki/File_extension "File extension"), including [Microsoft Office](/wiki/Microsoft_Office "Microsoft Office"), [OpenDocument](/wiki/OpenDocument "OpenDocument"), and other documents, pictures, and [AutoCAD](/wiki/AutoCAD "AutoCAD") files.[\[8\]](#cite_note-cw-cryptolocker-8) The payload displays a message informing the user that files have been encrypted, and demands a payment of 400 [USD](/wiki/United_States_dollar "United States dollar") or [Euro](/wiki/Euro "Euro") through an anonymous pre-paid cash voucher (i.e. [MoneyPak](/wiki/Green_Dot_Corporation "Green Dot Corporation") or [Ukash](/wiki/Ukash "Ukash")), or an equivalent amount in [bitcoin](/wiki/Bitcoin "Bitcoin") (BTC) within 72 or 100 hours (while starting at 2 BTC, the ransom price has been adjusted down to 0.3 BTC by the operators to reflect the fluctuating value of bitcoin),[\[11\]](#cite_note-zdnet-bitcoinprice-11) or else the private key on the server would be destroyed, and "nobody and never \[ _[sic](/wiki/Sic "Sic")_\] will be able to restore files."[\[1\]](#cite_note-ars-cryptolocker-1)[\[7\]](#cite_note-details-7) Payment of the ransom allows the user to download the decryption program, which is pre-loaded with the user's private key.[\[7\]](#cite_note-details-7) Some infected victims claim that they paid the attackers but their files were not decrypted.[\[5\]](#cite_note-securityweek131119-5)

In November 2013, the operators of CryptoLocker launched an online service that claimed to allow users to decrypt their files without the CryptoLocker program, and to purchase the decryption key after the deadline had expired; the process involved uploading an encrypted file to the site as a sample and waiting for the service to find a match; the site claimed that a match would be found within 24 hours. Once found, the user could pay for the key online; if the 72-hour deadline passed, the cost increased to 10 bitcoin.[\[12\]](#cite_note-nw-cryptolockersecondchance-12)[\[13\]](#cite_note-pcw-moremoney-13)

### Takedown and recovery of files

\[ [edit](/w/index.php?title=CryptoLocker&action=edit&section=2 "Edit section: Takedown and recovery of files")\]

On 2 June 2014, the [United States Department of Justice](/wiki/United_States_Department_of_Justice "United States Department of Justice") officially announced that over the previous weekend, [Operation Tovar](/wiki/Operation_Tovar "Operation Tovar")—a consortium constituting a group of law enforcement agencies (including the [FBI](/wiki/FBI "FBI") and [Interpol](/wiki/Interpol "Interpol")), security software vendors, and several universities, had disrupted the [Gameover ZeuS](/wiki/Gameover_ZeuS "Gameover ZeuS") [botnet](/wiki/Botnet "Botnet") which had been used to distribute CryptoLocker and other malware. The Department of Justice also publicly issued an [indictment](/wiki/Indictment "Indictment") against the Russian hacker Evgeniy Bogachev for his alleged involvement in the botnet.[\[6\]](#cite_note-krebs2014-6)[\[14\]](#cite_note-cw-whambam-14)[\[15\]](#cite_note-doj-takedown-15)[\[16\]](#cite_note-16)

As part of the operation, the Dutch security firm Fox-IT was able to procure the database of private keys used by CryptoLocker; in August 2014, Fox-IT and fellow firm FireEye introduced an online service which allows infected users to retrieve their private key by uploading a sample file, and then receive a decryption tool.[\[17\]](#cite_note-krebs-recover-17)[\[18\]](#cite_note-takedown-18)

## Mitigation

\[ [edit](/w/index.php?title=CryptoLocker&action=edit&section=3 "Edit section: Mitigation")\]

While security software is designed to detect such threats, it might not detect CryptoLocker at all, or only after encryption is underway or complete, particularly if a new version unknown to the protective software is distributed.[\[19\]](#cite_note-19) If an attack is suspected or detected in its early stages, it takes some time for encryption to take place; immediate removal of the malware (a relatively simple process) before it has completed would limit its damage to data.[\[20\]](#cite_note-malwarebytes-20)[\[21\]](#cite_note-register-21) Experts suggested precautionary measures, such as using software or other security policies to block the CryptoLocker payload from launching.[\[1\]](#cite_note-ars-cryptolocker-1)[\[7\]](#cite_note-details-7)[\[8\]](#cite_note-cw-cryptolocker-8)[\[10\]](#cite_note-guardian-cryptolocker-10)[\[21\]](#cite_note-register-21)

Due to the nature of CryptoLocker's operation, some experts reluctantly suggested that paying the ransom was the only way to recover files from CryptoLocker in the absence of current backups ( [offline](/wiki/Off-line_storage "Off-line storage") backups made before the infection that are inaccessible from infected computers cannot be attacked by CryptoLocker).[\[5\]](#cite_note-securityweek131119-5) Due to the length of the key employed by CryptoLocker, experts considered it practically impossible to use a [brute-force attack](/wiki/Brute-force_attack "Brute-force attack") to obtain the key needed to decrypt files without paying ransom; the similar 2008 trojan Gpcode.AK used a 1024-bit key that was believed to be large enough to be computationally infeasible to break without a concerted [distributed](/wiki/Distributed_computing "Distributed computing") effort, or the discovery of a flaw that could be used to break the encryption.[\[7\]](#cite_note-details-7)[\[13\]](#cite_note-pcw-moremoney-13)[\[22\]](#cite_note-zdnet-2-22)[\[23\]](#cite_note-securityfocus-23) [Sophos](/wiki/Sophos "Sophos") security analyst Paul Ducklin speculated that CryptoLocker's online decryption service involved a [dictionary attack](/wiki/Dictionary_attack "Dictionary attack") against its own encryption using its database of keys, explaining the requirement to wait up to 24 hours to receive a result.[\[13\]](#cite_note-pcw-moremoney-13)

## Money paid

\[ [edit](/w/index.php?title=CryptoLocker&action=edit&section=4 "Edit section: Money paid")\]

In December 2013, [ZDNet](/wiki/ZDNet "ZDNet") traced four bitcoin addresses posted by users who had been infected by CryptoLocker, in an attempt to gauge the operators' takings. The four addresses showed movement of 41,928 BTC between 15 October and 18 December, about US$27 million at that time.[\[11\]](#cite_note-zdnet-bitcoinprice-11)

In a survey by researchers at the [University of Kent](/wiki/University_of_Kent "University of Kent"), 41% of those who claimed to be victims said that they had decided to pay the ransom, a proportion much larger than expected; Symantec had estimated that 3% of victims had paid and Dell SecureWorks had estimated that 0.4% of victims had paid.[\[24\]](#cite_note-24) Following the shutdown of the botnet that had been used to distribute CryptoLocker, it was calculated that about 1.3% of those infected had paid the ransom; many had been able to recover files which had been backed up, and others are believed to have lost huge amounts of data. Nonetheless, the operators were believed to have extorted a total of around $3 million.[\[18\]](#cite_note-takedown-18)

## Clones

\[ [edit](/w/index.php?title=CryptoLocker&action=edit&section=5 "Edit section: Clones")\]

The success of CryptoLocker spawned a number of [unrelated and similarly named](/wiki/Copycat_crime "Copycat crime") ransomware trojans working in essentially the same way,[\[25\]](#cite_note-arn-cryptolockerf-25)[\[26\]](#cite_note-computerworld-cryptodefense-26)[\[27\]](#cite_note-27)[\[28\]](#cite_note-tm-newcl-28) including some that refer to themselves as "CryptoLocker"—but are, according to security researchers, unrelated to the original CryptoLocker.[\[29\]](#cite_note-symantec-aus-29)[\[30\]](#cite_note-eset-cl2-30)[\[28\]](#cite_note-tm-newcl-28)

In September 2014, further clones such as CryptoWall and [TorrentLocker](/wiki/TorrentLocker "TorrentLocker") (whose payload identifies itself as "CryptoLocker", but is named for its use of a [registry key](/wiki/Registry_key "Registry key") named " [Bit Torrent](/wiki/BitTorrent "BitTorrent") Application"),[\[31\]](#cite_note-eset-torrentlocker-31) began spreading in Australia; the ransomware uses infected e-mails, purportedly sent by government departments (e.g. [Australia Post](/wiki/Australia_Post "Australia Post") to indicate a failed parcel delivery) as a payload. To evade detection by automatic e-mail scanners that can follow links, this variant was designed to require users to visit a web page and enter a [CAPTCHA](/wiki/CAPTCHA "CAPTCHA") code before the payload is actually downloaded. [Symantec](/wiki/NortonLifeLock "NortonLifeLock") determined that these new variants, which it identified as "CryptoLocker.F", were not tied to the original.[\[29\]](#cite_note-symantec-aus-29)[\[25\]](#cite_note-arn-cryptolockerf-25)[\[32\]](#cite_note-smh-cryptowall-32)[\[33\]](#cite_note-33)[\[34\]](#cite_note-34)[\[35\]](#cite_note-cso-abcnews24-35)

## See also

\[ [edit](/w/index.php?title=CryptoLocker&action=edit&section=6 "Edit section: See also")\]

- [Locky](/wiki/Locky "Locky")
- [PGPCoder](/wiki/PGPCoder "PGPCoder")
- [WannaCry](/wiki/WannaCry "WannaCry")
- [Petya](/wiki/Petya_(malware) "Petya (malware)")

## References

\[ [edit](/w/index.php?title=CryptoLocker&action=edit&section=7 "Edit section: References")\]

01. ^ [_**a**_](#cite_ref-ars-cryptolocker_1-0) [_**b**_](#cite_ref-ars-cryptolocker_1-1) [_**c**_](#cite_ref-ars-cryptolocker_1-2) [_**d**_](#cite_ref-ars-cryptolocker_1-3)Goodin, Dan (17 October 2013). ["You're infected—if you want to see your data again, pay us $300 in Bitcoins"](https://arstechnica.com/security/2013/10/youre-infected-if-you-want-to-see-your-data-again-pay-us-300-in-bitcoins/). _Ars Technica_. [Archived](https://web.archive.org/web/20131023230916/http://arstechnica.com/security/2013/10/youre-infected-if-you-want-to-see-your-data-again-pay-us-300-in-bitcoins/) from the original on 23 October 2013. Retrieved 23 October 2013.
02. **[^](#cite_ref-bbc241213_2-0)**Kelion, Leo (24 December 2013). ["Cryptolocker ransomware has 'infected about 250,000 PCs'"](https://www.bbc.com/news/technology-25506020). _BBC_. [Archived](https://web.archive.org/web/20190322141441/https://www.bbc.com/news/technology-25506020) from the original on 22 March 2019. Retrieved 24 December 2013.
03. **[^](#cite_ref-3)**["CryptoLocker"](https://www.avast.com/c-cryptolocker). [Archived](https://web.archive.org/web/20170914173038/https://www.avast.com/c-cryptolocker) from the original on 14 September 2017. Retrieved 14 September 2017.
04. **[^](#cite_ref-4)**["'Operation Tovar' Targets 'Gameover' ZeuS Botnet, CryptoLocker Scourge – Krebs on Security"](https://krebsonsecurity.com/2014/06/operation-tovar-targets-gameover-zeus-botnet-cryptolocker-scourge/). 2 June 2014. Retrieved 5 September 2023.
05. ^ [_**a**_](#cite_ref-securityweek131119_5-0) [_**b**_](#cite_ref-securityweek131119_5-1) [_**c**_](#cite_ref-securityweek131119_5-2)["Cryptolocker Infections on the Rise; US-CERT Issues Warning"](http://www.securityweek.com/cryptolocker-infections-rise-us-cert-issues-warning). _SecurityWeek_. 19 November 2013. [Archived](https://web.archive.org/web/20160610183317/http://www.securityweek.com/cryptolocker-infections-rise-us-cert-issues-warning) from the original on 10 June 2016. Retrieved 18 January 2014.
06. ^ [_**a**_](#cite_ref-krebs2014_6-0) [_**b**_](#cite_ref-krebs2014_6-1)Krebs, Brian (2 June 2014). ["'Operation Tovar' Targets 'Gameover' ZeuS Botnet, CryptoLocker Scourge"](http://krebsonsecurity.com/2014/06/operation-tovar-targets-gameover-zeus-botnet-cryptolocker-scourge/). Krebs on Security. [Archived](https://web.archive.org/web/20140604174558/http://krebsonsecurity.com/2014/06/operation-tovar-targets-gameover-zeus-botnet-cryptolocker-scourge/) from the original on 4 June 2014. Retrieved 18 August 2014.
07. ^ [_**a**_](#cite_ref-details_7-0) [_**b**_](#cite_ref-details_7-1) [_**c**_](#cite_ref-details_7-2) [_**d**_](#cite_ref-details_7-3) [_**e**_](#cite_ref-details_7-4) [_**f**_](#cite_ref-details_7-5)Abrams, Lawrence. ["CryptoLocker Ransomware Information Guide and FAQ"](http://www.bleepingcomputer.com/virus-removal/cryptolocker-ransomware-information). _[Bleeping Computer](/wiki/Bleeping_Computer "Bleeping Computer")_. [Archived](https://web.archive.org/web/20131117080533/http://www.bleepingcomputer.com/virus-removal/CryptoLocker-ransomware-information) from the original on 17 November 2013. Retrieved 25 October 2013.
08. ^ [_**a**_](#cite_ref-cw-cryptolocker_8-0) [_**b**_](#cite_ref-cw-cryptolocker_8-1) [_**c**_](#cite_ref-cw-cryptolocker_8-2)Hassell, Jonathan (25 October 2013). ["Cryptolocker: How to avoid getting infected and what to do if you are"](https://www.computerworld.com/article/2485214/cryptolocker-how-to-avoid-getting-infected-and-what-to-do-if-you-are.html). _Computerworld_. [Archived](https://web.archive.org/web/20190402192236/https://www.computerworld.com/article/2485214/cryptolocker-how-to-avoid-getting-infected-and-what-to-do-if-you-are.html) from the original on 2 April 2019. Retrieved 25 October 2013.
09. **[^](#cite_ref-sophos-cryptolocker_9-0)**Ducklin, Paul (12 October 2013). ["Destructive malware "CryptoLocker" on the loose – here's what to do"](https://nakedsecurity.sophos.com/2013/10/12/destructive-malware-cryptolocker-on-the-loose/). _Naked Security_. Sophos. [Archived](https://web.archive.org/web/20170508022456/https://nakedsecurity.sophos.com/2013/10/12/destructive-malware-cryptolocker-on-the-loose/) from the original on 8 May 2017. Retrieved 23 October 2013.
10. ^ [_**a**_](#cite_ref-guardian-cryptolocker_10-0) [_**b**_](#cite_ref-guardian-cryptolocker_10-1)Ferguson, Donna (19 October 2013). ["CryptoLocker attacks that hold your computer to ransom"](https://www.theguardian.com/money/2013/oct/19/cryptolocker-attacks-computer-ransomeware). _The Guardian_. [Archived](https://web.archive.org/web/20170305034848/https://www.theguardian.com/money/2013/oct/19/cryptolocker-attacks-computer-ransomeware) from the original on 5 March 2017. Retrieved 23 October 2013.
11. ^ [_**a**_](#cite_ref-zdnet-bitcoinprice_11-0) [_**b**_](#cite_ref-zdnet-bitcoinprice_11-1)[Blue, Violet](/wiki/Violet_Blue "Violet Blue") (22 December 2013). ["CryptoLocker's crimewave: A trail of millions in laundered Bitcoin"](https://www.zdnet.com/article/cryptolockers-crimewave-a-trail-of-millions-in-laundered-bitcoin/). ZDNet. [Archived](https://web.archive.org/web/20131223011159/http://www.zdnet.com/cryptolockers-crimewave-a-trail-of-millions-in-laundered-bitcoin-7000024579/) from the original on 23 December 2013. Retrieved 23 December 2013.
12. **[^](#cite_ref-nw-cryptolockersecondchance_12-0)**["CryptoLocker crooks charge 10 Bitcoins for second-chance decryption service"](https://www.csoonline.com/article/2225714/cryptolocker-crooks-charge-10-bitcoins-for-second-chance-decryption-service.html). _CSO_. 4 November 2013. [Archived](https://web.archive.org/web/20210119181255/https://www.csoonline.com/article/2225714/cryptolocker-crooks-charge-10-bitcoins-for-second-chance-decryption-service.html) from the original on 19 January 2021. Retrieved 5 November 2013.
13. ^ [_**a**_](#cite_ref-pcw-moremoney_13-0) [_**b**_](#cite_ref-pcw-moremoney_13-1) [_**c**_](#cite_ref-pcw-moremoney_13-2)Constantin, Lucian (4 November 2013). ["CryptoLocker creators try to extort even more money from victims with new service"](http://www.pcworld.com/article/2060640/cryptolocker-creators-try-to-extort-even-more-money-from-victims-with-new-service.html). _PC World_. [Archived](https://web.archive.org/web/20170430230656/http://pcworld.com/article/2060640/cryptolocker-creators-try-to-extort-even-more-money-from-victims-with-new-service.html) from the original on 30 April 2017. Retrieved 5 November 2013.
14. **[^](#cite_ref-cw-whambam_14-0)**Storm, Darlene (2 June 2014). ["Wham bam: Global Operation Tovar whacks CryptoLocker ransomware & GameOver Zeus botnet"](https://web.archive.org/web/20140703092912/http://blogs.computerworld.com/cybercrime-and-hacking/23980/wham-bam-global-operation-tovar-whacks-cryptolocker-ransomware-gameover-zeus-botnet). _Computerworld_. IDG. Archived from [the original](http://blogs.computerworld.com/cybercrime-and-hacking/23980/wham-bam-global-operation-tovar-whacks-cryptolocker-ransomware-gameover-zeus-botnet) on 3 July 2014. Retrieved 18 August 2014.
15. **[^](#cite_ref-doj-takedown_15-0)**["U.S. Leads Multi-National Action Against "Gameover Zeus" Botnet and "Cryptolocker" Ransomware, Charges Botnet Administrator"](https://www.justice.gov/opa/pr/2014/June/14-crm-584.html). _Justice.gov_ (Press release). U.S. Department of Justice. [Archived](https://web.archive.org/web/20140903075329/http://www.justice.gov/opa/pr/2014/June/14-crm-584.html) from the original on 3 September 2014. Retrieved 18 August 2014.
16. **[^](#cite_ref-16)**Graff, Garrett M. (21 March 2017). ["Inside the Hunt for Russia's Most Notorious Hacker"](https://www.wired.com/2017/03/russian-hacker-spy-botnet/). _Wired_. [ISSN](/wiki/ISSN_(identifier) "ISSN (identifier)") [1059-1028](https://search.worldcat.org/issn/1059-1028). [Archived](https://web.archive.org/web/20200105032731/https://www.wired.com/2017/03/russian-hacker-spy-botnet/) from the original on 5 January 2020. Retrieved 18 January 2020.
17. **[^](#cite_ref-krebs-recover_17-0)**Krebs, Brian (15 August 2014). ["New Site Recovers Files Locked by Cryptolocker Ransomware"](http://krebsonsecurity.com/2014/08/new-site-recovers-files-locked-by-cryptolocker-ransomware/). _Krebs on Security_. [Archived](https://web.archive.org/web/20170607013755/http://krebsonsecurity.com/2014/08/new-site-recovers-files-locked-by-cryptolocker-ransomware/) from the original on 7 June 2017. Retrieved 18 August 2014.
18. ^ [_**a**_](#cite_ref-takedown_18-0) [_**b**_](#cite_ref-takedown_18-1)Ward, Mark (6 August 2014). ["Cryptolocker victims to get files back for free"](https://www.bbc.co.uk/news/technology-28661463). BBC News. [Archived](https://web.archive.org/web/20200113064828/https://www.bbc.co.uk/news/technology-28661463) from the original on 13 January 2020. Retrieved 18 August 2014.
19. **[^](#cite_ref-19)**[The Yuma Sun, on a CryptoLocker attack](http://www.yumasun.com/news/local/article_f38f14e8-4f50-11e3-8165-0019bb30f31a.html) [Archived](https://web.archive.org/web/20171008143617/http://www.yumasun.com/news/local/article_f38f14e8-4f50-11e3-8165-0019bb30f31a.html) 8 October 2017 at the [Wayback Machine](/wiki/Wayback_Machine "Wayback Machine"): "... was able to go undetected by the antivirus software used by the Yuma Sun because it was Zero-day malware"
20. **[^](#cite_ref-malwarebytes_20-0)**Cannell, Joshua (8 October 2013). ["Cryptolocker Ransomware: What You Need To Know, last updated 06/02/2014"](https://www.malwarebytes.com/blog/news/2013/10/cryptolocker-ransomware-what-you-need-to-know). _Malwarebytes Unpacked_. [Archived](https://web.archive.org/web/20220927204518/https://www.malwarebytes.com/blog/news/2013/10/cryptolocker-ransomware-what-you-need-to-know) from the original on 27 September 2022. Retrieved 19 October 2013.
21. ^ [_**a**_](#cite_ref-register_21-0) [_**b**_](#cite_ref-register_21-1)Leyden, Josh (18 October 2013). ["Fiendish CryptoLocker ransomware: Whatever you do, don't PAY"](https://www.theregister.co.uk/2013/10/18/cryptolocker_ransmware). _The Register_. [Archived](https://web.archive.org/web/20131018131317/http://www.theregister.co.uk/2013/10/18/cryptolocker_ransmware/) from the original on 18 October 2013. Retrieved 18 October 2013.
22. **[^](#cite_ref-zdnet-2_22-0)**Naraine, Ryan (6 June 2008). ["Blackmail ransomware returns with 1024-bit encryption key"](https://web.archive.org/web/20080803000014/http://blogs.zdnet.com/security/?p=1251). _[ZDnet](/wiki/ZDnet "ZDnet")_. Archived from [the original](http://blogs.zdnet.com/security/?p=1251) on 3 August 2008. Retrieved 25 October 2013.
23. **[^](#cite_ref-securityfocus_23-0)**Lemos, Robert (13 June 2008). ["Ransomware resisting crypto cracking efforts"](http://www.securityfocus.com/news/11523). _[SecurityFocus](/wiki/SecurityFocus "SecurityFocus")_. [Archived](https://web.archive.org/web/20160303194706/http://www.securityfocus.com/news/11523) from the original on 3 March 2016. Retrieved 25 October 2013.
24. **[^](#cite_ref-24)**["Results of online survey by Interdisciplinary Research Centre in Cyber Security at the University of Kent in Canterbury"](https://web.archive.org/web/20140308080430/http://www.cybersec.kent.ac.uk/Survey2.pdf)(PDF). _kent.ac.uk_. University of Kent in Canterbury. Archived from [the original](http://www.cybersec.kent.ac.uk/Survey2.pdf)(PDF) on 8 March 2014. Retrieved 25 March 2014.
25. ^ [_**a**_](#cite_ref-arn-cryptolockerf_25-0) [_**b**_](#cite_ref-arn-cryptolockerf_25-1)Budmar, Patrick (3 October 2014). ["Australia specifically targeted by Cryptolocker: Symantec"](http://www.arnnet.com.au/article/556598/australia-specifically-targeted-by-cryptolocker-symantec/). _ARNnet_. [Archived](https://web.archive.org/web/20141007191221/http://www.arnnet.com.au/article/556598/australia-specifically-targeted-by-cryptolocker-symantec/) from the original on 7 October 2014. Retrieved 15 October 2014.
26. **[^](#cite_ref-computerworld-cryptodefense_26-0)**Kirk, Jeremy (1 April 2014). ["CryptoDefense ransomware leaves decryption key accessible"](http://www.computerworld.com/s/article/9247348/CryptoDefense_ransomware_leaves_decryption_key_accessible). _Computerworld_. IDG. [Archived](https://web.archive.org/web/20140703000139/http://www.computerworld.com/s/article/9247348/CryptoDefense_ransomware_leaves_decryption_key_accessible) from the original on 3 July 2014. Retrieved 7 April 2014.
27. **[^](#cite_ref-27)**Thomson, Iain (3 April 2014). ["Your files held hostage by CryptoDefense? Don't pay up! The decryption key is on your hard drive"](https://www.theregister.co.uk/2014/04/03/cryptodefense_rsa_private_key_on_disk/). The Register. [Archived](https://web.archive.org/web/20161226042004/http://www.theregister.co.uk/2014/04/03/cryptodefense_rsa_private_key_on_disk) from the original on 26 December 2016. Retrieved 6 April 2014.
28. ^ [_**a**_](#cite_ref-tm-newcl_28-0) [_**b**_](#cite_ref-tm-newcl_28-1)Pichel, Abigail (26 December 2013). ["New CryptoLocker Spreads via Removable Drives"](https://web.archive.org/web/20131228222607/http://blog.trendmicro.com/trendlabs-security-intelligence/new-cryptolocker-spreads-via-removable-drives/). Trend Micro. Archived from [the original](http://blog.trendmicro.com/trendlabs-security-intelligence/new-cryptolocker-spreads-via-removable-drives/) on 28 December 2013. Retrieved 18 January 2014.
29. ^ [_**a**_](#cite_ref-symantec-aus_29-0) [_**b**_](#cite_ref-symantec-aus_29-1)["Australians increasingly hit by global tide of cryptomalware"](https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=c878f0a5-5416-46ca-8a73-8889a53cff2f&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments). Symantec. [Archived](https://web.archive.org/web/20160329043821/http://www.symantec.com/connect/blogs/australians-increasingly-hit-global-tide-cryptomalware) from the original on 29 March 2016. Retrieved 15 October 2014.
30. **[^](#cite_ref-eset-cl2_30-0)**["Cryptolocker 2.0 – new version, or copycat?"](http://www.welivesecurity.com/2013/12/19/cryptolocker-2-0-new-version-or-copycat/). _WeLiveSecurity_. ESET. 19 December 2013. [Archived](https://web.archive.org/web/20161122005648/http://www.welivesecurity.com/2013/12/19/cryptolocker-2-0-new-version-or-copycat/) from the original on 22 November 2016. Retrieved 18 January 2014.
31. **[^](#cite_ref-eset-torrentlocker_31-0)**["TorrentLocker now targets UK with Royal Mail phishing"](http://www.welivesecurity.com/2014/09/04/torrentlocker-now-targets-uk-royal-mail-phishing/). ESET. 4 September 2014. [Archived](https://web.archive.org/web/20141021065547/http://www.welivesecurity.com/2014/09/04/torrentlocker-now-targets-uk-royal-mail-phishing/) from the original on 21 October 2014. Retrieved 22 October 2014.
32. **[^](#cite_ref-smh-cryptowall_32-0)**Turner, Adam (15 October 2014). ["Scammers use Australia Post to mask email attacks"](http://www.smh.com.au/digital-life/consumer-security/scammers-use-australia-post-to-mask-email-attacks-20141015-10ru0s.html). _Sydney Morning Herald_. [Archived](https://web.archive.org/web/20141016045825/http://www.smh.com.au/digital-life/consumer-security/scammers-use-australia-post-to-mask-email-attacks-20141015-10ru0s.html) from the original on 16 October 2014. Retrieved 15 October 2014.
33. **[^](#cite_ref-33)**Staff. ["Cryptolocker Ransomware attack"](https://www.cmeoex.com/#/home). Retrieved 27 June 2023.
34. **[^](#cite_ref-34)**Staff. ["Ransomware attack"](https://cmeoq.com/syn/?t=crypto). Retrieved 21 July 2023.
35. **[^](#cite_ref-cso-abcnews24_35-0)**Ragan, Steve (7 October 2014). ["Ransomware attack knocks TV station off air"](http://www.csoonline.com/article/2692614/malware-cybercrime/ransomware-attack-knocks-tv-station-off-air.html). _CSO_. [Archived](https://web.archive.org/web/20161012223059/http://www.csoonline.com/article/2692614/malware-cybercrime/ransomware-attack-knocks-tv-station-off-air.html) from the original on 12 October 2016. Retrieved 15 October 2014.

- [v](/wiki/Template:Hacking_in_the_2010s "Template:Hacking in the 2010s")
- [t](/wiki/Template_talk:Hacking_in_the_2010s "Template talk:Hacking in the 2010s")
- [e](/wiki/Special:EditPage/Template:Hacking_in_the_2010s "Special:EditPage/Template:Hacking in the 2010s")

Hacking in the 2010s

← [2000s](/wiki/Template:Hacking_in_the_2000s "Template:Hacking in the 2000s")[Timeline](/wiki/Timeline_of_computer_security_hacker_history#2010s "Timeline of computer security hacker history")[2020s](/wiki/Template:Hacking_in_the_2020s "Template:Hacking in the 2020s") →

Major incidents

2010

- [Operation Aurora](/wiki/Operation_Aurora "Operation Aurora") (publication of 2009 events)
- [Australian cyberattacks](/wiki/February_2010_Australian_cyberattacks "February 2010 Australian cyberattacks")
- [Operation Olympic Games](/wiki/Operation_Olympic_Games "Operation Olympic Games")
- [Operation ShadowNet](/wiki/Shadow_Network "Shadow Network")
- [Operation Payback](/wiki/Operation_Payback "Operation Payback")

2011

- [Canadian government](/wiki/2011_Canadian_government_hackings "2011 Canadian government hackings")
- [DigiNotar](/wiki/DigiNotar "DigiNotar")
- [DNSChanger](/wiki/DNSChanger "DNSChanger")
- [HBGary Federal](/wiki/HBGary "HBGary")
- [Operation AntiSec](/wiki/Operation_AntiSec "Operation AntiSec")
- [PlayStation network outage](/wiki/2011_PlayStation_Network_outage "2011 PlayStation Network outage")
- [RSA SecurID compromise](/wiki/RSA_SecurID#March_2011_system_compromise "RSA SecurID")

2012

- [LinkedIn hack](/wiki/2012_LinkedIn_hack "2012 LinkedIn hack")
- [Stratfor email leak](/wiki/Stratfor_email_leak "Stratfor email leak")
- [Operation High Roller](/wiki/Operation_High_Roller "Operation High Roller")

2013

- [South Korea cyberattack](/wiki/2013_South_Korea_cyberattack "2013 South Korea cyberattack")
- [Snapchat hack](/wiki/Snapchat#December_2013_hack "Snapchat")
- [Cyberterrorism attack of June 25](/wiki/June_25_cyber_terror "June 25 cyber terror")
- [2013 Yahoo! data breach](/wiki/Yahoo!_data_breaches#August_2013:_breach "Yahoo! data breaches")
- [Singapore cyberattacks](/wiki/2013_Singapore_cyberattacks "2013 Singapore cyberattacks")

2014

- [Anthem medical data breach](/wiki/Anthem_medical_data_breach "Anthem medical data breach")
- [Operation Tovar](/wiki/Operation_Tovar "Operation Tovar")
- [2014 celebrity nude photo leak](/wiki/2014_celebrity_nude_photo_leak "2014 celebrity nude photo leak")
- [2014 JPMorgan Chase data breach](/wiki/2014_JPMorgan_Chase_data_breach "2014 JPMorgan Chase data breach")
- [2014 Sony Pictures hack](/wiki/2014_Sony_Pictures_hack "2014 Sony Pictures hack")
- [Russian hacker password theft](/wiki/2014_Russian_hacker_password_theft "2014 Russian hacker password theft")
- [2014 Yahoo! data breach](/wiki/Yahoo!_data_breaches#Late_2014:_breach "Yahoo! data breaches")

2015

- [Office of Personnel Management data breach](/wiki/Office_of_Personnel_Management_data_breach "Office of Personnel Management data breach")
- [Hacking Team](/wiki/Hacking_Team#2015_data_breach "Hacking Team")
- [Ashley Madison data breach](/wiki/Ashley_Madison_data_breach "Ashley Madison data breach")
- [VTech data breach](/wiki/VTech#2015_data_breach "VTech")
- [Ukrainian Power Grid Cyberattack](/wiki/2015_Ukraine_power_grid_hack "2015 Ukraine power grid hack")
- [SWIFT banking hack](/wiki/2015%E2%80%932016_SWIFT_banking_hack "2015–2016 SWIFT banking hack")

2016

- [Bangladesh Bank robbery](/wiki/Bangladesh_Bank_robbery "Bangladesh Bank robbery")
- [Hollywood Presbyterian Medical Center ransomware incident](/wiki/Hollywood_Presbyterian_Medical_Center#Ransomware "Hollywood Presbyterian Medical Center")
- [Commission on Elections data breach](/wiki/Commission_on_Elections_data_breach "Commission on Elections data breach")
- [Democratic National Committee cyber attacks](/wiki/Democratic_National_Committee_cyber_attacks "Democratic National Committee cyber attacks")
- [Vietnam Airport Hacks](/wiki/Vietnamese_airports_hackings "Vietnamese airports hackings")
- [DCCC cyber attacks](/wiki/Democratic_Congressional_Campaign_Committee_cyber_attacks "Democratic Congressional Campaign Committee cyber attacks")
- [Indian Bank data breaches](/wiki/2016_Indian_Banks_data_breach "2016 Indian Banks data breach")
- [Surkov leaks](/wiki/Surkov_leaks "Surkov leaks")
- [Dyn cyberattack](/wiki/DDoS_attacks_on_Dyn "DDoS attacks on Dyn")
- [Russian interference in the 2016 U.S. elections](/wiki/Russian_interference_in_the_2016_United_States_elections "Russian interference in the 2016 United States elections")
- [2016 Bitfinex hack](/wiki/2016_Bitfinex_hack "2016 Bitfinex hack")

2017

- [SHAttered](/wiki/SHA1#SHAttered_–_first_public_collision "SHA1")
- [2017 Macron e-mail leaks](/wiki/2017_Macron_e-mail_leaks "2017 Macron e-mail leaks")
- [WannaCry ransomware attack](/wiki/WannaCry_ransomware_attack "WannaCry ransomware attack")
- [Westminster data breach](/wiki/2017_Westminster_data_breach "2017 Westminster data breach")
- [Petya and NotPetya](/wiki/Petya_(malware_family) "Petya (malware family)")
  - [2017 Ukraine ransomware attacks](/wiki/2017_Ukraine_ransomware_attacks "2017 Ukraine ransomware attacks")
- [Equifax data breach](/wiki/2017_Equifax_data_breach "2017 Equifax data breach")
- [Deloitte breach](/wiki/Deloitte#E-mail_hack "Deloitte")
- [Disqus breach](/wiki/Disqus#October_2017_security_breach "Disqus")

2018

- [Trustico](/wiki/Trustico#DigiCert_and_Trustico_spat,_2018 "Trustico")
- [Atlanta cyberattack](/wiki/Atlanta_government_ransomware_attack "Atlanta government ransomware attack")
- [SingHealth data breach](/wiki/2018_SingHealth_data_breach "2018 SingHealth data breach")

2019

- [Sri Lanka cyberattack](/wiki/2019_cyberattacks_on_Sri_Lanka "2019 cyberattacks on Sri Lanka")
- [Baltimore ransomware attack](/wiki/2019_Baltimore_ransomware_attack "2019 Baltimore ransomware attack")
- [Bulgarian revenue agency hack](/wiki/2019_Bulgarian_revenue_agency_hack "2019 Bulgarian revenue agency hack")
- [WhatsApp snooping scandal](/wiki/WhatsApp_snooping_scandal "WhatsApp snooping scandal")
- [Jeff Bezos phone hacking incident](/wiki/Jeff_Bezos_phone_hacking_incident "Jeff Bezos phone hacking incident")

[Hacktivism](/wiki/Hacktivism "Hacktivism")

- [Anonymous](/wiki/Anonymous_(hacker_group) "Anonymous (hacker group)")
  - [associated events](/wiki/Timeline_of_events_associated_with_Anonymous "Timeline of events associated with Anonymous")
- [CyberBerkut](/wiki/CyberBerkut "CyberBerkut")
- [GNAA](/wiki/Gay_Nigger_Association_of_America "Gay Nigger Association of America")
- [Goatse Security](/wiki/Goatse_Security "Goatse Security")
- [Lizard Squad](/wiki/Lizard_Squad "Lizard Squad")
- [LulzRaft](/wiki/LulzRaft "LulzRaft")
- [LulzSec](/wiki/LulzSec "LulzSec")
- [New World Hackers](/wiki/2016_Dyn_cyberattack#Perpetrators "2016 Dyn cyberattack")
- [NullCrew](/wiki/NullCrew "NullCrew")
- [OurMine](/wiki/OurMine "OurMine")
- [PayPal 14](/wiki/PayPal_14 "PayPal 14")
- [RedHack](/wiki/RedHack "RedHack")
- [Teamp0ison](/wiki/Teamp0ison "Teamp0ison")
- [TDO](/wiki/The_Dark_Overlord_(hacker_group) "The Dark Overlord (hacker group)")
- [UGNazi](/wiki/UGNazi "UGNazi")
- [Ukrainian Cyber Alliance](/wiki/Ukrainian_Cyber_Alliance "Ukrainian Cyber Alliance")

[Advanced\
\
persistent threats](/wiki/Advanced_persistent_threat "Advanced persistent threat")

- [Bangladesh Black Hat Hackers](/wiki/Bangladesh_Black_Hat_Hackers "Bangladesh Black Hat Hackers")
- [Bureau 121](/wiki/Bureau_121 "Bureau 121")
- [Charming Kitten](/wiki/Charming_Kitten "Charming Kitten")
- [Cozy Bear](/wiki/Cozy_Bear "Cozy Bear")
- [Dark Basin](/wiki/Dark_Basin "Dark Basin")
- [DarkMatter](/wiki/DarkMatter_Group "DarkMatter Group")
- [Elfin Team](/wiki/Elfin_Team "Elfin Team")
- [Equation Group](/wiki/Equation_Group "Equation Group")
- [Fancy Bear](/wiki/Fancy_Bear "Fancy Bear")
- [GOSSIPGIRL](/wiki/Stuxnet#History "Stuxnet") (confederation)
- [Guccifer 2.0](/wiki/Guccifer_2.0 "Guccifer 2.0")
- [Hacking Team](/wiki/Hacking_Team "Hacking Team")
- [Helix Kitten](/wiki/Helix_Kitten "Helix Kitten")
- [Iranian Cyber Army](/wiki/Iranian_Cyber_Army "Iranian Cyber Army")
- [Lazarus Group](/wiki/Lazarus_Group "Lazarus Group") ( [BlueNorOff](/wiki/Lazarus_Group#BlueNorOff "Lazarus Group")) ( [AndAriel](/wiki/Lazarus_Group#AndAriel "Lazarus Group"))
- [NSO Group](/wiki/NSO_Group "NSO Group")
- [Numbered Panda](/wiki/Numbered_Panda "Numbered Panda")
- [PLA Unit 61398](/wiki/PLA_Unit_61398 "PLA Unit 61398")
- [PLA Unit 61486](/wiki/PLA_Unit_61486 "PLA Unit 61486")
- [PLATINUM](/wiki/PLATINUM_(cybercrime_group) "PLATINUM (cybercrime group)")
- [Pranknet](/wiki/Pranknet "Pranknet")
- [Red Apollo](/wiki/Red_Apollo "Red Apollo")
- [Rocket Kitten](/wiki/Rocket_Kitten "Rocket Kitten")
- [Stealth Falcon](/wiki/Stealth_Falcon "Stealth Falcon")
- [Syrian Electronic Army](/wiki/Syrian_Electronic_Army "Syrian Electronic Army")
- [Tailored Access Operations](/wiki/Tailored_Access_Operations "Tailored Access Operations")
- [The Shadow Brokers](/wiki/The_Shadow_Brokers "The Shadow Brokers")
- [xDedic](/wiki/XDedic "XDedic")
- [Yemen Cyber Army](/wiki/Yemen_Cyber_Army "Yemen Cyber Army")

[Individuals](/wiki/Hacker "Hacker")

- [Ryan Ackroyd](/wiki/Ryan_Ackroyd "Ryan Ackroyd")
- [Mustafa Al-Bassam](/wiki/Mustafa_Al-Bassam "Mustafa Al-Bassam")
- [Cyber Anakin](/wiki/Cyber_Anakin "Cyber Anakin")
- [George Hotz](/wiki/George_Hotz "George Hotz")
- [Guccifer](/wiki/Guccifer "Guccifer")
- [Elliott Gunton](/wiki/Elliott_Gunton "Elliott Gunton")
- [Jeremy Hammond](/wiki/Jeremy_Hammond "Jeremy Hammond")
- [Kristoffer von Hassel](/wiki/Kristoffer_von_Hassel "Kristoffer von Hassel")
- [Junaid Hussain](/wiki/Junaid_Hussain "Junaid Hussain")
- [MLT](/wiki/MLT_(hacktivist) "MLT (hacktivist)")
- [Sabu](/wiki/Hector_Monsegur "Hector Monsegur")
- [Track2](/wiki/Roman_Seleznev "Roman Seleznev")
- [Topiary](/wiki/Topiary_(hacktivist) "Topiary (hacktivist)")
- [The Jester](/wiki/The_Jester_(hacktivist) "The Jester (hacktivist)")

Major [vulnerabilities](/wiki/Vulnerability_(computing) "Vulnerability (computing)")

publicly [disclosed](/wiki/Full_disclosure_(computer_security) "Full disclosure (computer security)")

- [Evercookie](/wiki/Evercookie "Evercookie") (2010)
- [iSeeYou](/wiki/ISeeYou "ISeeYou") (2013)
- [Heartbleed](/wiki/Heartbleed "Heartbleed") (2014)
- [Shellshock](/wiki/Shellshock_(software_bug) "Shellshock (software bug)") (2014)
- [POODLE](/wiki/POODLE "POODLE") (2014)
- [Rootpipe](/wiki/Rootpipe "Rootpipe") (2014)
- [Row hammer](/wiki/Row_hammer "Row hammer") (2014)
- [SS7 vulnerabilities](/wiki/Signaling_System_No._7#Protocol_security_vulnerabilities "Signaling System No. 7") (2014)
- [WinShock](/wiki/WinShock "WinShock") (2014)
- [JASBUG](/wiki/JASBUG "JASBUG") (2015)
- [Stagefright](/wiki/Stagefright_(bug) "Stagefright (bug)") (2015)
- [DROWN](/wiki/DROWN_attack "DROWN attack") (2016)
- [Badlock](/wiki/Badlock "Badlock") (2016)
- [Dirty COW](/wiki/Dirty_COW "Dirty COW") (2016)
- [Cloudbleed](/wiki/Cloudbleed "Cloudbleed") (2017)
- [Broadcom Wi-Fi](/wiki/Broadcom_Corporation#soc-wifi-vulns "Broadcom Corporation") (2017)
- [EternalBlue](/wiki/EternalBlue "EternalBlue") (2017)
- [DoublePulsar](/wiki/DoublePulsar "DoublePulsar") (2017)
- [Silent Bob is Silent](/wiki/Intel_Active_Management_Technology#Silent_Bob_is_Silent "Intel Active Management Technology") (2017)
- [KRACK](/wiki/KRACK "KRACK") (2017)
- [ROCA vulnerability](/wiki/ROCA_vulnerability "ROCA vulnerability") (2017)
- [BlueBorne](/wiki/BlueBorne_(security_vulnerability) "BlueBorne (security vulnerability)") (2017)
- [Meltdown](/wiki/Meltdown_(security_vulnerability) "Meltdown (security vulnerability)") (2018)
- [Spectre](/wiki/Spectre_(security_vulnerability) "Spectre (security vulnerability)") (2018)
- [EFAIL](/wiki/EFAIL "EFAIL") (2018)
- [Exactis](/wiki/Exactis "Exactis") (2018)
- [Speculative Store Bypass](/wiki/Speculative_Store_Bypass "Speculative Store Bypass") (2018)
- [Lazy FP state restore](/wiki/Lazy_FP_state_restore "Lazy FP state restore") (2018)
- [TLBleed](/wiki/TLBleed "TLBleed") (2018)
- [SigSpoof](/wiki/SigSpoof "SigSpoof") (2018)
- [Foreshadow](/wiki/Foreshadow "Foreshadow") (2018)
- [Dragonblood](/wiki/Wi-Fi_Protected_Access#Dragonblood_attack "Wi-Fi Protected Access") (2019)
- [Microarchitectural Data Sampling](/wiki/Microarchitectural_Data_Sampling "Microarchitectural Data Sampling") (2019)
- [BlueKeep](/wiki/BlueKeep "BlueKeep") (2019)
- [Kr00k](/wiki/Kr00k "Kr00k") (2019)

[Malware](/wiki/Malware "Malware")

2010

- [Bad Rabbit](/wiki/Ransomware#Bad_Rabbit "Ransomware")
- [Black Energy 2](/wiki/BlackEnergy#BlackEnergy_2_(BE2) "BlackEnergy")
- [SpyEye](/wiki/SpyEye "SpyEye")
- [Stuxnet](/wiki/Stuxnet "Stuxnet")

2011

- [Coreflood](/wiki/Coreflood "Coreflood")
- [Alureon](/wiki/Alureon "Alureon")
- [Duqu](/wiki/Duqu "Duqu")
- [Kelihos](/wiki/Kelihos_botnet "Kelihos botnet")
- [Metulji botnet](/wiki/Metulji_botnet "Metulji botnet")
- [Stars](/wiki/Stars_virus "Stars virus")

2012

- [Carna](/wiki/Carna_botnet "Carna botnet")
- [Dexter](/wiki/Dexter_(malware) "Dexter (malware)")
- [FBI](/wiki/FBI_MoneyPak_Ransomware "FBI MoneyPak Ransomware")
- [Flame](/wiki/Flame_(malware) "Flame (malware)")
- [Mahdi](/wiki/Mahdi_(malware) "Mahdi (malware)")
- [Red October](/wiki/Red_October_(malware) "Red October (malware)")
- [Shamoon](/wiki/Shamoon "Shamoon")

2013

- CryptoLocker
- [DarkSeoul](/wiki/2013_South_Korea_cyberattack "2013 South Korea cyberattack")

2014

- [Brambul](/wiki/Brambul "Brambul")
- [Black Energy 3](/wiki/BlackEnergy#BlackEnergy_3_(BE3) "BlackEnergy")
- [Carbanak](/wiki/Carbanak "Carbanak")
- [Careto](/wiki/Careto_(malware) "Careto (malware)")
- [DarkHotel](/wiki/DarkHotel "DarkHotel")
- [Duqu 2.0](/wiki/Duqu_2.0 "Duqu 2.0")
- [FinFisher](/wiki/FinFisher "FinFisher")
- [Gameover ZeuS](/wiki/Gameover_ZeuS "Gameover ZeuS")
- [Regin](/wiki/Regin_(malware) "Regin (malware)")

2015

- [Dridex](/wiki/Dridex "Dridex")
- [Hidden Tear](/wiki/Hidden_Tear "Hidden Tear")
- [Rombertik](/wiki/Rombertik "Rombertik")
- [TeslaCrypt](/wiki/TeslaCrypt "TeslaCrypt")

2016

- [Hitler](/wiki/Hitler-Ransomware "Hitler-Ransomware")
- [Jigsaw](/wiki/Jigsaw_(ransomware) "Jigsaw (ransomware)")
- [KeRanger](/wiki/KeRanger "KeRanger")
- [Necurs](/wiki/Necurs "Necurs")
- [MEMZ](/wiki/MEMZ "MEMZ")
- [Mirai](/wiki/Mirai_(malware) "Mirai (malware)")
- [Pegasus](/wiki/Pegasus_(spyware) "Pegasus (spyware)")
- [Petya and NotPetya](/wiki/Petya_and_NotPetya "Petya and NotPetya")
- [X-Agent](/wiki/X-Agent "X-Agent")

2017

- [BrickerBot](/wiki/BrickerBot "BrickerBot")
- [Kirk](/wiki/Kirk_Ransomware "Kirk Ransomware")
- [LogicLocker](/wiki/LogicLocker "LogicLocker")
- [Rensenware](/wiki/Rensenware "Rensenware")
- [Triton](/wiki/Triton_(malware) "Triton (malware)")
- [WannaCry](/wiki/WannaCry_ransomware_attack "WannaCry ransomware attack")
- [XafeCopy](/wiki/Xafecopy_Trojan "Xafecopy Trojan")

2018

- [VPNFilter](/wiki/VPNFilter "VPNFilter")

2019

- [Grum](/wiki/Grum_botnet "Grum botnet")
- [Joanap](/wiki/Joanap "Joanap")
- [NetTraveler](/wiki/NetTraveler "NetTraveler")
- [R2D2](/wiki/Chaos_Computer_Club#Staatstrojaner_affair "Chaos Computer Club")
- [Tinba](/wiki/Tiny_Banker_Trojan "Tiny Banker Trojan")
- [Titanium](/wiki/Titanium_(malware) "Titanium (malware)")
- [ZeroAccess botnet](/wiki/ZeroAccess_botnet "ZeroAccess botnet")

Retrieved from " [https://en.wikipedia.org/w/index.php?title=CryptoLocker&oldid=1232783766](https://en.wikipedia.org/w/index.php?title=CryptoLocker&oldid=1232783766)"

[Categories](/wiki/Help:Category "Help:Category"):

- [Blackmail](/wiki/Category:Blackmail "Category:Blackmail")
- [Cyberattacks](/wiki/Category:Cyberattacks "Category:Cyberattacks")
- [Cybercrime](/wiki/Category:Cybercrime "Category:Cybercrime")
- [September 2013 events](/wiki/Category:September_2013_events "Category:September 2013 events")
- [Cryptographic attacks](/wiki/Category:Cryptographic_attacks "Category:Cryptographic attacks")
- [2013 in computing](/wiki/Category:2013_in_computing "Category:2013 in computing")
- [Ransomware](/wiki/Category:Ransomware "Category:Ransomware")
- [Hacking in the 2010s](/wiki/Category:Hacking_in_the_2010s "Category:Hacking in the 2010s")
- [Windows trojans](/wiki/Category:Windows_trojans "Category:Windows trojans")

Hidden categories:

- [Webarchive template wayback links](/wiki/Category:Webarchive_template_wayback_links "Category:Webarchive template wayback links")
- [Articles with short description](/wiki/Category:Articles_with_short_description "Category:Articles with short description")
- [Short description matches Wikidata](/wiki/Category:Short_description_matches_Wikidata "Category:Short description matches Wikidata")
- [Use dmy dates from November 2013](/wiki/Category:Use_dmy_dates_from_November_2013 "Category:Use dmy dates from November 2013")

- This page was last edited on 5 July 2024, at 15:43 (UTC).
- Text is available under the [Creative Commons Attribution-ShareAlike License 4.0](//en.wikipedia.org/wiki/Wikipedia:Text_of_the_Creative_Commons_Attribution-ShareAlike_4.0_International_License);
additional terms may apply. By using this site, you agree to the [Terms of Use](//foundation.wikimedia.org/wiki/Special:MyLanguage/Policy:Terms_of_Use) and [Privacy Policy](//foundation.wikimedia.org/wiki/Special:MyLanguage/Policy:Privacy_policy). Wikipedia® is a registered trademark of the [Wikimedia Foundation, Inc.](//wikimediafoundation.org/), a non-profit organization.

- [Privacy policy](https://foundation.wikimedia.org/wiki/Special:MyLanguage/Policy:Privacy_policy)
- [About Wikipedia](/wiki/Wikipedia:About)
- [Disclaimers](/wiki/Wikipedia:General_disclaimer)
- [Contact Wikipedia](//en.wikipedia.org/wiki/Wikipedia:Contact_us)
- [Code of Conduct](https://foundation.wikimedia.org/wiki/Special:MyLanguage/Policy:Universal_Code_of_Conduct)
- [Developers](https://developer.wikimedia.org)
- [Statistics](https://stats.wikimedia.org/#/en.wikipedia.org)
- [Cookie statement](https://foundation.wikimedia.org/wiki/Special:MyLanguage/Policy:Cookie_statement)
- [Mobile view](//en.m.wikipedia.org/w/index.php?title=CryptoLocker&mobileaction=toggle_view_mobile)

- [![Wikimedia Foundation](/static/images/footer/wikimedia-button.svg)](https://wikimediafoundation.org/)
- [![Powered by MediaWiki](/w/resources/assets/poweredby_mediawiki.svg)](https://www.mediawiki.org/)