December 17, 2014 By Shane Schick 2 min read

Security researchers say OphionLocker, a recently discovered strain of malicious software that takes over a user’s system until a payment is made, may be among the first to use one of the most advanced techniques for encrypting data files.

First reported by Trojan7Malware, this type of ransomware is believed to spread via online advertising campaigns that fool users into clicking on an area of a website that then takes over their computer. Those infected by OphionLocker need to fork over $300 in the virtual currency Bitcoin in order to get their system and data back.

Researchers at F-Secure Labs posted screenshots that showed how OphionLocker presents the ransom demand via a text file that informs victims that their photos, documents and other files have been encrypted and inaccessible to anyone but the cybercriminals. Website addresses within the text files are also difficult to detect because they are based on Tor, a protocol designed to protect the anonymity of those using it.

OphionLocker Ahead of the Curve

What makes this ransomware notable, however, is its use of elliptic curve cryptography (ECC). In an Ars Technica article, a former Apple engineer described ECC — which is not yet well understood, even by some in the IT industry — as the possible next generation of public key infrastructure. This suggests that those behind the attacks may be more experienced cybercriminals than those involved with other ransomware strains.

On the other hand, an article on Tom’s Guide suggested that OphionLocker shares some characteristics with threats such as CryptoWall and SynoLocker, which have emerged in the past year. This includes the use of the RIG exploit kit, a pack of software files that takes advantage of vulnerabilities in commonly used browsers such as Microsoft’s Internet Explorer. According to Kahu Security, the RIG exploit kit has been widely available in underground markets since this spring and is relatively inexpensive for cybercriminals at approximately $300 a week.

The Register pointed out that CTB Locker also used ECC, but this is less about bragging rights for the ransomware’s author and more about recognizing this as a particularly sophisticated form of attack. Ironically, the only ones safe from OphionLocker may be the security researchers themselves, who have discovered that it doesn’t really work if you’re studying malware threats in a virtual computing environment. For everyone else, the best prevention will probably sound familiar: Use antivirus software, be careful what you click on and hope for the best.

More from

Regulatory harmonization in OT-critical infrastructure faces hurdles

3 min read - In an effort to enhance cyber resilience across critical infrastructure, the Office of the National Cyber Director (ONCD) has recently released a summary of feedback from its 2023 Cybersecurity Regulatory Harmonization Request for Information (RFI). The responses reveal major concerns from critical infrastructure industries related to operational technology (OT), such as energy, transport and manufacturing. Their worries include the current fragmented regulatory landscape and difficulty adapting to new cyber regulations. The frustration appears to be unanimous. Meanwhile, the magnitude of…

Generative AI security requires a solid framework

4 min read - How many companies intentionally refuse to use AI to get their work done faster and more efficiently? Probably none: the advantages of AI are too great to deny.The benefits AI models offer to organizations are undeniable, especially for optimizing critical operations and outputs. However, generative AI also comes with risk. According to the IBM Institute for Business Value, 96% of executives say adopting generative AI makes a security breach likely in their organization within the next three years.CISA Director Jen…

Q&A with Valentina Palmiotti, aka chompie

4 min read - The Pwn2Own computer hacking contest has been around since 2007, and during that time, there has never been a female to score a full win — until now.This milestone was reached at Pwn2Own 2024 in Vancouver, where two women, Valentina Palmiotti and Emma Kirkpatrick, each secured full wins by exploiting kernel vulnerabilities in Microsoft Windows 11. Prior to this year, only Amy Burnett and Alisa Esage had competed in the contest's 17-year history, with Esage achieving a partial win in…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today