Loading story…
ESET reported that malware branded "CryptoLocker 2.0" is likely not a new version of the original CryptoLocker but a separate copycat ransomware family using the name for credibility and profit. The company said the threat, detected as MSIL/Filecoder.D and MSIL/Filecoder.E, still encrypts victim files with public-key cryptography and demands payment, but differs substantially from the original in its programming language, encryption workflow, command-and-control behavior, ransom process, and the types of files it targets. Unlike the original CryptoLocker, the newer strain was written in C#, targets a broader set of consumer media files, stores encrypted keys in separate .k files, and accepts ransom payments only in Bitcoin.
Researchers said the malware also carries broader trojan functionality beyond file encryption. ESET observed samples masquerading as software cracks, spreading through removable media, stealing Bitcoin wallets, launching BFGMiner, and potentially supporting DDoS activity. The company warned that, despite being a copycat rather than the original operation, the malware can still cause serious damage to victims who lack reliable backups, and it urged users to maintain current backups and updated security protections.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Beyond file encryption, ESET observed capabilities including masquerading as software cracks, spreading via removable media, stealing Bitcoin wallets, launching BFGMiner, and potentially conducting DDoS attacks. ESET warned that the malware could still seriously harm victims without backups.
ESET reported that the newer malware differed substantially from the original CryptoLocker in programming language, encryption workflow, ransom payment options, targeted file types, and command-and-control behavior. It was written in C#, stored encrypted keys in separate .k files, targeted a broader set of consumer media files, and accepted only Bitcoin.
ESET analyzed a ransomware family calling itself 'Cryptolocker 2.0' and concluded it was probably not a new version of the original CryptoLocker but a separate copycat operation using the name for criminal profit. The malware was detected as MSIL/Filecoder.D and MSIL/Filecoder.E.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that **TeslaCrypt 2.0** was being distributed while posing as **CryptoWall**, a tactic that blurred attribution and complicated incident response for victims and defenders. The malware used CryptoWall-themed ransom messaging and presentation while retaining TeslaCrypt functionality, indicating that operators were deliberately leveraging the better-known ransomware brand to increase credibility and pressure victims into paying. The campaign highlighted how ransomware groups were already adapting both their code and social engineering to improve payment rates and evade straightforward identification. For defenders, the overlap in branding and behavior underscored the need to rely on technical indicators and malware analysis rather than ransom-note labels alone when classifying infections, assessing impact, and selecting containment and recovery actions.
Jul 4, 2026
**CryptoLocker** emerged as a highly disruptive ransomware operation that encrypted files with strong public-key cryptography, including data on local drives, removable media, and accessible network shares, then demanded roughly **$300/€300** in **Bitcoin** or MoneyPak for the private key. Victims were warned they had only about **72 hours** to pay before losing access permanently, and reports indicated that the malware’s encryption was generally not breakable, leaving organizations and consumers dependent on payment or unaffected backups. Security reporting also noted that some victims who paid did receive working decryption keys, while disruptions to command-and-control infrastructure sometimes prevented even paying victims from recovering files. The operators later added a **"second chance"** decryption portal that raised the price from **2 bitcoins** during the initial deadline to **10 bitcoins** after expiration, effectively turning the campaign into a more structured extortion service. Coverage linked the operation to the use of **Tor** and resilient backend infrastructure to conceal command systems and maintain contact with victims, while later reporting traced **millions of dollars in laundered Bitcoin** tied to the crimewave. The campaign underscored how ransomware actors were combining strong encryption, anonymous payment channels, and hidden services to industrialize file-encryption extortion at scale.
Jun 29, 2026
LockBit 5.0 has emerged as the latest evolution of the notorious ransomware-as-a-service operation, introducing sophisticated encryption algorithms and advanced anti-analysis techniques that significantly complicate detection and recovery efforts for targeted organizations. The malware now employs a combination of ChaCha20-Poly1305 for file encryption and X25519 with BLAKE2b for secure key exchange, while also terminating Volume Shadow Copy Service processes to prevent system recovery. LockBit 5.0’s runtime flexibility allows it to operate even without specific parameters, and its use of advanced packing and obfuscation further hinders static analysis by security professionals. Despite increased law enforcement pressure, LockBit has sustained its position as a dominant global ransomware threat, accounting for a substantial share of attacks worldwide. The group’s operations have impacted a wide range of sectors, including IT, electronics, law firms, and religious institutions, resulting in billions of dollars in ransom payments and recovery costs. LockBit continues to leverage its dark web platform to publicly list compromised organizations and stolen data, using these tactics to pressure victims into paying ransoms.
Jun 29, 2026