A file-encrypting ransomware program called CryptoWall infected over 600,000 computer systems in the past six months and held 5 billion files hostage, earning its creators more than US$1 million, researchers found.
The Counter Threat Unit (CTU) at Dell SecureWorks performed an extensive analysis of CryptoWall that involved gathering data from its command-and-control (C&C) servers, tracking its variants and distribution methods and counting payments made by victims so far.
CryptoWall is "the largest and most destructive ransomware threat on the Internet" at the moment and will likely continue to grow, the CTU researchers said Wednesday in a blog post that details their findings.
The threat has been spreading since at least November 2013, but until the first quarter of this year it remained mostly overshadowed by CryptoLocker, another ransomware program that infected over half a million systems from September 2013 through May.
CryptoLocker asked victims for ransoms between $100 and $500 to recover their encrypted files and is estimated to have earned its creators around $3 million over 9 months of operation. The threat was shut down at the end of May following a multi-national law enforcement operation that had support from security vendors.
CryptoWall filled the void left by CryproLocker on the ransomware landscape through aggressive distribution using a variety of tactics that included spam emails with malicious links or attachments, drive-by-download attacks from sites infected with exploit kits and through installations by other malware programs already running on compromised computers.
The CryptoWall command-and-control servers assign a unique identifier to every infection and generate RSA public-private key pairs for each one.
The public keys are sent to infected computers and are used by the malware to encrypt files with popular extensions -- movies, images, documents, etc. -- that are stored on local hard drives, as well as on mapped network shares, including those from cloud storage services like Dropbox and Google Drive.
Files encrypted with an RSA public key can only be decrypted with its corresponding private key, which remains in the possession of the attackers and is only released after the ransom has been paid.
The CTU researchers were able to count the unique computer identifiers from the CryptoWall servers and also obtained information about their IP (Internet Protocol) address, approximate time of infection, and payment status.
"Between mid-March and August 24, 2014, nearly 625,000 systems were infected with CryptoWall," the CTU researchers said. "In that same timeframe, CryptoWall encrypted more than 5.25 billion files."
The largest number of infected systems were located in the United States -- 253,521 or 40.6 percent of the total. The next most affected countries were Vietnam with 66,590 infections, the U.K. with 40,258, Canada with 32,579 and India with 22,582.
Sign up for CIO Asia eNewsletters.