After this process was complete, a notice or pop-up window would appear, which would list the payment terms for the ransom. This meant that the local files were encrypted in the background without being detected. The tricky part was that the user did not actively noticeit.

On that website, the download of an infected file started automatically and the malware immediately installed itself. There was the possibility to become a victim of a cryptolocker ransomware attack, even if a user just followed a link to a malicious website. This could happen via Java Script or Acrobat Reader. If the cryptolocker ransomware attack was carried out through a website, the polymorphic virus would be downloaded via an update. The attackers disguised themselves as federal institutions, online traders, applicants or business partners. This could be, for example, a compressed zip or rar file, a word document or a picture – in the form of a jpeg.

The users received an infected file attachment in their electronic mailbox. The emails and web pages were primarily used as a gateway.

The cryptolocker ransomware could enter the computers in two ways.

What does crypto locker do