CryptoLocker malware demands bitcoin ransom

Cybercriminals are infecting people's computers with malware then demanding a bitcoin ransom for the decryption key.

AccessTimeIconOct 19, 2013 at 8:30 a.m. UTC
Updated Feb 21, 2023 at 3:46 p.m. UTC
10 Years of Decentralizing the Future
May 29-31, 2024 - Austin, TexasThe biggest and most established global event for everything crypto, blockchain and Web3.Register Now

A piece of malware is currently terrorising computer users by encrypting their data and charging a ransom – in fiat currency or bitcoins – to decrypt the information.

Called CryptoLocker, the ransom malware is contained within phishing emails, so it infects a users computer when they open an attachment in one of these messages.

Yuval Ben-Itzhak, CTO at security software company AVG, said: "Ransom malware has been around in different variations since the early 1990’s."

He went on to explain that a victim of the malware would typically receive an email that pretends to be from a well-known brand such as Fedex, UPS and DHS and claims to be related to a customer support issue.

"The email would have a zip file attachment which contains the executable code for the malware disguised as a PDF file. If the user clicks on this PDF icon, it infects the computer as soon as it opens," Ben-Itzhak added.

Once a computer is infected, a message is displayed on the screen, stating: "To obtain the private key for this computer, which will automatically decrypt files, you need to pay 300 USD / 300 EUR / similar amount in another currency."

Users are given a choice of payment method, but CryptoLocker describes bitcoin as the "most cheap option" and asks for 2 BTC.


Forum members have been sharing the information they know about CryptoLocker on reddit, discussing its features, how it is spread and which antivirus software catches it.

A roundup post by forum member 'bluesoul' informs that there is a version of CryptoLocker that demands $100 and another that asks for $300. It also reveals that the victim's files will be encrypted before the warning message displays on their screen.

"I thought it was worth mentioning that by the time the notification pops up, it's already encrypted everything. It's silent until the job is done," bluesoul's forum post reads.


recently published a post on its blog stating that it is seeing an influx of customers who are trying to buy bitcoins to pay to those behind the CryptoLocker malware.

The UK bitcoin exchange said it is not selling coins to anyone who need them for Crypto-Locker.

"Knowingly accepting money so that the coins may be sent to the criminals would turn the service into a money laundering operation, encourage the criminals to take this to a higher level, not to mention the sellers could easily get tangled up in a police investigation or get their bank accounts frozen," Bitbargain's blog post explains.

AVG's Ben-Itzhak said users can minimise the risk of their computer becoming infected by this or other types of malware by having an active and up-to-date antivirus program on their PC.

Bitbargain, however, offered this advice: "The moral of the story is: always have backups, always update your software (especially Adobe Reader which has a very bad history of vulnerabilities resulting in code execution), and do not open e-mail attachments unless you know who sent it."

Have you been affected by CryptoLocker? Let us know your thoughts on this malware in the comments.

Image credit: Peas via Ars Technica


Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

CoinDesk is an award-winning media outlet that covers the cryptocurrency industry. Its journalists abide by a strict set of editorial policies. In November 2023, CoinDesk was acquired by the Bullish group, owner of Bullish, a regulated, digital assets exchange. The Bullish group is majority-owned by; both companies have interests in a variety of blockchain and digital asset businesses and significant holdings of digital assets, including bitcoin. CoinDesk operates as an independent subsidiary with an editorial committee to protect journalistic independence. CoinDesk employees, including journalists, may receive options in the Bullish group as part of their compensation.

Learn more about Consensus 2024, CoinDesk's longest-running and most influential event that brings together all sides of crypto, blockchain and Web3. Head to to register and buy your pass now.