The Demon CryptoLocker, Father of All Ransoms

Legend

Born in September 2013, it encrypted files with RSA keys and demanded the ransom in Bitcoin, setting the template every ransomware would copy. It travelled aboard the GameOver Zeus botnet. It was exorcised in June 2014 by Operation Tovar, which dismantled the botnet and allowed the keys to be recovered.

Exorcism

Cast it out with regular, offline backups, tested with a real restore. Filter executable attachments in email and keep systems and antivirus up to date.

Technical record

Circle

Circle III · Ransomware and extortion

First seen

2013

Status

Exorcised (Operation Tovar, 2014-06-02)

Works

The Miracle of Operation Tovar

Ransomware first seen in September 2013 that encrypted files with RSA keys and demanded payment in Bitcoin, setting the template for modern ransomware. It was distributed largely through the GameOver Zeus botnet and reportedly extorted millions of dollars. Operation Tovar disrupted it in June 2014, after which a decryption service was released.