98.55% of victims targeted by TorrentLocker do not pay the virus' bitcoin ransom, according to a new report.
TorrentLocker (aka Win32 or Filecoder.DI) is a strain of bitcoin ransomware that works by encrypting users' files. Victims are requested to pay up to 4 BTC to decrypt their documents, though this figure can vary.
"In other words 1.44% of all infected users we have identified have paid the ransom to the cybercriminals," Léveillé writes, adding: "There are also 20 pages showing that bitcoins were sent but access to the decryption software wasn’t given because the full amount wasn’t paid."
Attackers targeted specific regions
Spam campaigns designed to distribute TorrentLocker malware were targeted at specific countries, including Austria, France, Germany, Italy and the UK, the report found.
Turkey and Australia were particularly hard hit by the malware campaign.
According to data from C&C servers, more than 284 million documents have been encrypted by the ransomware so far.
While very few victims chose to pay the ransom, the distributors of TorrentLocker, who are also suspected of being behind the Hesperbot banking trojan, have made a substantial amount of money – between $292,700 and $585,401.
The report notes that ESET identified the first traces of TorrentLocker in February 2014. However, its developers reacted to online reports and changed the way the malware uses AES encryption after a method of decrypting the key was found.
Crypto-ransomware remains a threat
Cybercriminals have been targeting unsuspecting victims with crypto-ransomware for more than a year, with CryptoLocker the leading virus in the field.
In June 2014, international authorities managed to cripple the CryptoLocker onslaught by disabling GOZeuS, the P2P network used to control the network. By the time this blow was struck, CryptoLocker was blamed for causing $27m in damages.
Although TorrentLocker has had limited reach compared to CryptoLocker, in late November the virus was infecting computers at a rate of 691.5 per day. The average TorrentLocker ransom stands at 1.334 BTC with a rebate, or 2.668 BTC afterwards. The exact figure collected by the attackers remains unclear.
Léveillé's report explains why further analysis is difficult:
While questions remain about how to stop the operators behind botnets like TorrentLocker, Léveillé suggests one way to remedy infections in the meantime: an offline backup.
TorrentLocker charts via ESET/Marc-Etienne M Léveillé, ransomware image via Shutterstock.
The leader in news and information on cryptocurrency, digital assets and the future of money, CoinDesk is a media outlet that strives for the highest journalistic standards and abides by a strict set of editorial policies. CoinDesk is an independent operating subsidiary of Digital Currency Group, which invests in cryptocurrencies and blockchain startups. As part of their compensation, certain CoinDesk employees, including editorial employees, may receive exposure to DCG equity in the form of stock appreciation rights, which vest over a multi-year period. CoinDesk journalists are not allowed to purchase stock outright in DCG.