Systems AffectedMicrosoft WindowsOverviewRansomware is a type of malicious software (malware) that infects a computer and restricts access to it until a ransom is paid to unlock it. This Alert is the result of Canadian Cyber Incident Response Centre (CCIRC) analysis in coordination with the United States Department of Homeland Security (DHS) to provide further information about crypto ransomware, specifically to:Present its main characteristics, explain the prevalence of ransomware, and the proliferation of crypto ransomware variants; andProvide prevention and mitigation information.DescriptionWHAT IS RANSOMWARE?Ransomware is a type of malware that infects a computer and restricts a users access to the infected computer. This type of malware, which has now been observed for several years, attempts to extort money from victims by displaying an on-screen alert. These alerts often state that their computer has been locked or that all of their files have been encrypted, and demand that a ransom is paid to restore access. This ransom is typically in the range of $100$300 dollars, and is sometimes demanded in virtual currency, such as Bitcoin.Ransomware is typically spread through phishing emails that contain malicious attachments and drive-by downloading. Drive-by downloading occurs when a user unknowingly visits an infected website and malware is downloaded and installed without their knowledge. Crypto ransomware, a variant that encrypts files, is typically spread through similar methods, and has been spread through Web-based instant messaging applications.WHY IS IT SO EFFECTIVE?The authors of ransomware instill fear and panic into their victims, causing them to click on a link or pay a ransom, and inevitably become infected with additional malware, including messages similar to those below:Your computer has been infected with a virus. Click here to resolve the issue.Your computer was used to visit websites with illegal content. To unlock your computer, you must pay a $100 fine.All files on your computer have been encrypted. You must pay this ransom within 72 hours to regain access to your data.PROLIFERATION OF VARIANTSIn 2012, Symantec, using data from a command and control (C2) server of 5,700 computers compromised in one day, estimated that approximately 2.9 percent of those compromised users paid the ransom. With an average ransom of $200, this meant malicious actors profited $33,600 per day, or $394,400 per month, from a single C2 server. These rough estimates demonstrate how profitable ransomware can be for malicious actors.This financial success has likely led to a proliferation of ransomware variants. In 2013, more destructive and lucrative ransomware variants were introduced including Xorist, CryptorBit, and CryptoLocker. Some variants encrypt not just the files on the infected device but also the contents of shared or networked drives. These variants are considered destructive because they encrypt users and organizations files, and render them useless until criminals receive a ransom.Additional variants observed in 2014 included CryptoDefense and Cryptowall, which are also considered destructive. Reports indicate that CryptoDefense and Cryptowall share the same code, and that only the name of malware itself is different. Similar to CryptoLocker, these variants also encrypt files on the local computer, shared network files, and removable media.LINKS TO OTHER TYPES OF MALWARESystems infected with ransomware are