Cryptolocker: what it is and how to protect yourself from ransomware

Cryptolocker is a ransomware virus that appeared in the last quarter of 2013. It encrypts the files on your computer and demands a ransom for the key that unlocks them. In practice, it takes your computer hostage and lets it go only if you pay. And even if you pay, there’s no guarantee the attackers will keep their word.

The files are encrypted with a 2048-bit RSA key, which is practically impossible to crack, so without the attackers’ key they become inaccessible.

Which files does Cryptolocker attack?

The files that can be affected by this virus have the following extensions: *.odt, *.ods, *.odp, *.odm, *.odc, *.odb, *.doc, *.docx, *.docm, *.wps, *.xls, *.xlsx, *.xlsm, *.xlsb, *.xlk, *.ppt, *.pptx, *.pptm, *.mdb, *.accdb, *.pst, *.dwg, *.dxf, *.dxg, *.wpd, *.rtf, *.wb2, *.mdf, *.dbf, *.psd, *.pdd, *.eps, *.ai, *.indd, *.cdr, ????????.jpg, ????????.jpe, img_*.jpg, *.dng, *.3fr, *.arw, *.srf, *.sr2, *.bay, *.crw, *.cr2, *.dcr, *.kdc, *.erf, *.mef, *.mrw, *.nef, *.nrw, *.orf, *.raf, *.raw, *.rwl, *.rw2, *.r3d, *.ptx, *.pef, *.srw, *.x3f, *.der, *.cer, *.crt, *.pem, *.pfx, *.p12, *.p7b, *.p7c.

As you can see, Office suite files are exposed too (.doc, .docx, .xls, .xlsx, .pst), and they’re used heavily in companies in Romania.

How does Cryptolocker spread?

The most common infection routes are:

• infected attachments, sent in emails that appear to come from courier companies (FedEx, UPS) or from institutions;
• other infections, such as the Zbot trojan, which downloads it disguised as PDF attachments;
• exploits on compromised websites, which use vulnerabilities in the victim’s system to install the virus;
• trojans that pose as programs you need to watch videos online (usually found on adult websites);
• fake update requests for programs such as Flash Player and Java.

The methods have stayed almost the same. Flash Player hasn’t existed since 2021, so any request to update Flash is definitely fake, but attackers now use fake browser updates, fake invoices and delivery notifications, or pirated software.

Does Cryptolocker still exist in 2026?

Not in its original form. In June 2014, an international police operation (Operation Tovar) took down the network of infected computers through which Cryptolocker spread, and in August 2014 the security firms FireEye and Fox-IT made the recovered keys available to victims, so they could decrypt their files for free.

The name, however, has remained synonymous with ransomware, and its successors are much more dangerous. Today’s groups don’t just encrypt data; they also steal it and threaten to publish it (double extortion), and many rent out their ransomware to other criminals, as a service. You’ll find details in the articles on Ransomware as a Service (RaaS) and 5 reasons why ransomware can’t be stopped easily.

How do you protect yourself from ransomware?

• Backup following the 3-2-1 policy, with at least one offline or immutable copy that the virus can’t encrypt. Test restoring regularly.
• Updates for the operating system and for all your software, as soon as they come out.
• Antivirus protection on all computers, preferably one that also recognizes suspicious behavior, not just known viruses.
• Care with attachments and links: see how to check if an email is spam.
• Limited rights: employees don’t work with administrator accounts, and important accounts have two-step verification.

What should you do if you’ve been infected?

1. Disconnect the computer from the network immediately (cable and Wi-Fi), so the virus doesn’t reach other computers and the file servers.
2. Don’t pay the ransom: there’s no guarantee you’ll get your data back, and paying funds the next attacks.
3. Check No More Ransom to see whether there’s a free decryption tool for that virus.
4. Restore your data from backup, after the system has been cleaned or reinstalled. See also Backup as a Service.
5. Report the incident to DNSC (the National Cyber Security Directorate, Romania’s cybersecurity authority). For companies that fall under NIS2 (GEO 155/2024), reporting is mandatory.

If you want to know how prepared your company is for a ransomware attack, request a free IT audit. See also IT security.