Behind closed doors: measurement and analysis of CryptoLocker ransoms in Bitcoin

TLDR

Bitcoin, a decentralized cryptographic currency that has experienced proliferating popularity over the past few years, is the common denominator in a wide variety of cybercrime. We perform a measurement analysis of CryptoLocker, a family of ransomware that encrypts a victim's files until a ransom is paid, within the Bitcoin ecosystem from September 5, 2013 through January 31, 2014. Using information collected from online fora such as reddit and BitcoinTalk, we generated a cluster of 968 Bitcoin addresses belonging to CryptoLocker, analyzed ransom payment timestamps longitudinally and transversely to detect distribution changes, and constructed a network topology to detail CryptoLocker's financial infrastructure and obtain auxiliary information on the operation. We identified 795 ransom payments totaling 1,128.40 BTC ($310,472.38) and estimated that proceeds could have been worth up to $1.1 million at peak valuation, found evidence of connections to popular Bitcoin services such as Bitcoin Fog and BTC‑e, and highlighted the value of measurement analyses and threat intelligence for understanding the erratic cybercrime landscape.

Abstract

Bitcoin, a decentralized cryptographic currency that has experienced proliferating popularity over the past few years, is the common denominator in a wide variety of cybercrime. We perform a measurement analysis of CryptoLocker, a family of ransomware that encrypts a victim's files until a ransom is paid, within the Bitcoin ecosystem from September 5, 2013 through January 31, 2014. Using information collected from online fora, such as reddit and BitcoinTalk, as an initial starting point, we generate a cluster of 968 Bitcoin addresses belonging to CryptoLocker. We provide a lower bound for CryptoLocker's economy in Bitcoin and identify 795 ransom payments totalling 1,128.40 BTC ($310,472.38), but show that the proceeds could have been worth upwards of $1.1 million at peak valuation. By analyzing ransom payment timestamps both longitudinally across CryptoLocker's operating period and transversely across times of day, we detect changes in distributions and form conjectures on CryptoLocker that corroborate information from previous efforts. Additionally, we construct a network topology to detail CryptoLocker's financial infrastructure and obtain auxiliary information on the CryptoLocker operation. Most notably, we find evidence that suggests connections to popular Bitcoin services, such as Bitcoin Fog and BTC-e, and subtle links to other cybercrimes surrounding Bitcoin, such as the Sheep Marketplace scam of 2013. We use our study to underscore the value of measurement analyses and threat intelligence in understanding the erratic cybercrime landscape.