View source for OphionLocker: Joining in the Ransomware Race

{{Publication
|Botnet=OphionLocker,
|Feature=Encrypt files,
|Year=2014
|Date=2014-12-12
|Editor=F-Secure
|Link=https://www.f-secure.com/weblog/archives/00002777.html
|Type=Blogpost
|Abstract=Last August, we blogged about a series of Ransomware that included SynoLocker and CryptoWall. In our Cryptowall blogpost, we briefly mentioned the more advanced family of ransomware CTB-Locker, which uses elliptic curve cryptography for file encryption and Tor for communication with the command & control server.

This week, another ransomware emerged using the same cryptography for encryption. It was first spotted by Trojan7Malware from a malvertising campaign that used RIG exploit kit. They dubbed the malware as OphionLocker.

Upon infection, this malware uses a Tor2web URL for giving instructions on how to send the payment and obtain the decrpytor tool.
}}