also often infected with other malware. In the case of CryptoLocker, a user typically becomes infected by opening a malicious attachment from an email. This malicious attachment contains Upatre, a downloader, which infects the user with GameOver Zeus. GameOver Zeus is a variant of the Zeus Trojan that steals banking information and is also used to steal other types of data. Once a system is infected with GameOver Zeus, Upatre will also download CryptoLocker. Finally, CryptoLocker encrypts files on the infected system, and requests that a ransom be paid.The close ties between ransomware and other types of malware were demonstrated through the recent botnet disruption operation against GameOver Zeus, which also proved effective against CryptoLocker. In June 2014, an international law enforcement operation successfully weakened the infrastructure of both GameOver Zeus and CryptoLocker.ImpactRansomware doesnt only target home users; businesses can also become infected with ransomware, which can have negative consequences, including:Temporary or permanent loss of sensitive or proprietary information;Disruption to regular operations;Financial losses incurred to restore systems and files; andPotential harm to an organizations reputation.Paying the ransom does not guarantee the encrypted files will be released; it only guarantees that the malicious actors receive the victims money, and in some cases, their banking information. In addition, decrypting files does not mean the malware infection itself has been removed.SolutionInfections can be devastating to an individual or organization, and recovery can be a difficult process that may require the services of a reputable data recovery specialist.US-CERT and CCIRC recommend users and administrators take the following preventive measures to protect their computer networks from ransomware infection:Perform regular backups of all critical information to limit the impact of data or system loss and to help expedite the recovery process. Ideally, this data should be kept on a separate device, and backups should be stored offline.Maintain up-to-date anti-virus software.Keep your operating system and software up-to-date with the latest patches.Do not follow unsolicited web links in email. Refer to the Security Tip Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.Use caution when opening email attachments. For information on safely handling email attachments, see Recognizing and Avoiding Email Scams.Follow safe practices when browsing the web. See Good Security Habits and Safeguarding Your Data for additional details.Individuals or organizations are not encouraged to pay the ransom, as this does not guarantee files will be released. Report instances of fraud to the FBI at the Internet Crime Complaint Center or contact the CCIRC (link sends e-mail) .References Kaspersky Lab, Kaspersky Lab detects mobile Trojan Svpeng: Financial malware with ransomware capabilities now targeting U.S. (link is external)Sophos / Naked Security, Whats next for ransomware? CryptoWall picks up where CryptoLocker left off (link is external)Symantec, CryptoDefence, the CryptoLocker Imitator, Makes Over $34,000 in One Month (link is external)Symantec, Cryptolocker: A Thriving Menace (link is external)Symantec, Cryptolocker Q&A: Menace of the Year (link is external)Symantec, International Takedown Wounds Gameover Zeus Cybercrime Network (link is external)Revisions October 22, 2014: Initial ReleaseOctober 24, 2014: Minor edit to the reference sectionFonte: https://www.us-cert.gov/ncas/alerts/TA14-295A