CryptoLocker Expanded Bitcoin-Fueled Ransomware Extortion Through Tor and Paid Decryption

CryptoLocker emerged as a highly disruptive ransomware operation that encrypted files with strong public-key cryptography, including data on local drives, removable media, and accessible network shares, then demanded roughly $300/€300 in Bitcoin or MoneyPak for the private key. Victims were warned they had only about 72 hours to pay before losing access permanently, and reports indicated that the malware’s encryption was generally not breakable, leaving organizations and consumers dependent on payment or unaffected backups. Security reporting also noted that some victims who paid did receive working decryption keys, while disruptions to command-and-control infrastructure sometimes prevented even paying victims from recovering files.

The operators later added a "second chance" decryption portal that raised the price from 2 bitcoins during the initial deadline to 10 bitcoins after expiration, effectively turning the campaign into a more structured extortion service. Coverage linked the operation to the use of Tor and resilient backend infrastructure to conceal command systems and maintain contact with victims, while later reporting traced millions of dollars in laundered Bitcoin tied to the crimewave. The campaign underscored how ransomware actors were combining strong encryption, anonymous payment channels, and hidden services to industrialize file-encryption extortion at scale.