Security researchers say OphionLocker, a recently discovered strain of malicious software that takes over a user’s system until a payment is made, may be among the first to use one of the most advanced techniques for encrypting data files.

First reported by Trojan7Malware, this type of ransomware is believed to spread via online advertising campaigns that fool users into clicking on an area of a website that then takes over their computer. Those infected by OphionLocker need to fork over $300 in the virtual currency Bitcoin in order to get their system and data back.

Researchers at F-Secure Labs posted screenshots that showed how OphionLocker presents the ransom demand via a text file that informs victims that their photos, documents and other files have been encrypted and inaccessible to anyone but the cybercriminals. Website addresses within the text files are also difficult to detect because they are based on Tor, a protocol designed to protect the anonymity of those using it.

OphionLocker Ahead of the Curve

What makes this ransomware notable, however, is its use of elliptic curve cryptography (ECC). In an Ars Technica article, a former Apple engineer described ECC — which is not yet well understood, even by some in the IT industry — as the possible next generation of public key infrastructure. This suggests that those behind the attacks may be more experienced cybercriminals than those involved with other ransomware strains.

On the other hand, an article on Tom’s Guide suggested that OphionLocker shares some characteristics with threats such as CryptoWall and SynoLocker, which have emerged in the past year. This includes the use of the RIG exploit kit, a pack of software files that takes advantage of vulnerabilities in commonly used browsers such as Microsoft’s Internet Explorer. According to Kahu Security, the RIG exploit kit has been widely available in underground markets since this spring and is relatively inexpensive for cybercriminals at approximately $300 a week.

The Register pointed out that CTB Locker also used ECC, but this is less about bragging rights for the ransomware’s author and more about recognizing this as a particularly sophisticated form of attack. Ironically, the only ones safe from OphionLocker may be the security researchers themselves, who have discovered that it doesn’t really work if you’re studying malware threats in a virtual computing environment. For everyone else, the best prevention will probably sound familiar: Use antivirus software, be careful what you click on and hope for the best.

More from

Most organizations want security vendor consolidation

4 min read - Cybersecurity is complicated, to say the least. Maintaining a strong security posture goes far beyond knowing about attack groups and their devious TTPs. Merely understanding, coordinating and unifying security tools can be challenging.We quickly passed through the “not if, but when” stage of cyberattacks. Now, it’s commonplace for companies to have experienced multiple breaches. Today, cybersecurity has taken a seat in core business strategy discussions as the risks and costs have risen dramatically.For this reason, 75% of organizations seek to…

How IBM secures the U.S. Open

2 min read - More than 15 million tennis fans around the world visited the US Open app and website this year, checking scores, poring over statistics and watching highlights from hundreds of matches over the two weeks of the tournament. To help develop this world-class digital experience, IBM Consulting worked closely with the USTA, developing powerful generative AI models that transform tennis data into insights and original content. Using IBM watsonx, a next-generation AI and data platform, the team built and managed the entire…

How the FBI Fights Back Against Worldwide Cyberattacks

5 min read - In the worldwide battle against malicious cyberattacks, there is no organization more central to the fight than the Federal Bureau of Investigation (FBI). And recent years have proven that the bureau still has some surprises up its sleeve. In early May, the U.S. Department of Justice announced the conclusion of a U.S. government operation called MEDUSA. The operation disrupted a global peer-to-peer network of computers compromised by malware called Snake. Attributed to a unit of the Russian government Security Service,…

How NIST Cybersecurity Framework 2.0 Tackles Risk Management

4 min read - The NIST Cybersecurity Framework 2.0 (CSF) is moving into its final stages before its 2024 implementation. After the public discussion period to inform decisions for the framework closed in May, it’s time to learn more about what to expect from the changes to the guidelines. The updated CSF is being aligned with the Biden Administration’s National Cybersecurity Strategy, according to Cherilyn Pascoe, senior technology policy advisor with NIST, at the 2023 RSA Conference. This sets up the new CSF to…