CTB Locker
- Malware type
- ransomware
- Family
- Malware family
- Last IoC activity
- 2026-05-28 02:37:20
- Profile updated
- 2026-07-07 13:44:54
Targeted industries: financial-services healthcare-and-pharmaceutical education-and-nonprofits retail-and-hospitality
Context
CTB Locker is a form of ransomware that encrypts files on the victim's system, demanding a ransom payment in bitcoin for the decryption key. It was first observed in 2014 and primarily targets businesses by exploiting unpatched vulnerabilities.
Reports & references
- ESET — Eset Threat Report Q22020 (report)
- McAfee — How Groove Gang Is Shaking Up The Ransomware As A Service Market To Empower Affiliates (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Ctb Locker (report)
- samvartaka.github.io — Ctb Locker (report)