ctblocker
- First seen
- 2014-06-01 00:00:00
- Malware type
- ransomware
- Family
- Malware family
- Profile updated
- 2026-07-07 13:54:33
Context
aka Critroni CTB‑Locker emerged in mid‑2014, introducing a new era of ransomware by leveraging elliptic curve cryptography (ECC), Tor-based C&C communication, and Bitcoin payments—earning its name from “Curve-Tor-Bitcoin Locker.” It was packaged and sold as a ransomware kit for approximately $1,500–$3,000, allowing affiliates to deploy customized campaigns. The malware encrypts user data (including network and removable drives), changes desktop wallpapers, and appends file extensions like .CTBL, .CTB2, or randomized strings. Victims receive instructions for payment, typically within a limited timeframe, or risk permanent data loss. In 2015–2017, law enforcement and cybersecurity firms (including McAfee and Kaspersky) disrupted the network, arrested operators, and facilitated decryption tools.
Reports & references
- ransomlook.io — Ctblocker (report)
- cert.gov.az — Ctb Locker And Critroni Ransomware Information Guide And Faq (report)
- heimdalsecurity.com — Ctb Locker Ransomware (report)
- McAfee — Advanced Threat Research (report)
- eset.com — Ctb Locker Ransomware Striking In Europe And Latin America10 (report)