CTB-Locker ransomware encrypts WordPress sites and holds them hostage

A fresh strain of ransomware called CTB-Locker has popped up online, and it encrypts WordPress websites rather than users' computers. So far more than 100 sites have been affected.

The ransomware, also known as Critroni, operates more or less in the same way as traditional ransomware when it encrypts a user's files and demands fee in bitcoin to decrypt and return the data. In the case of CTB-Locker, which is a PHP program, it instead targets a website.

The culprit will usually hack a website that is poorly secured and replace its index.php or index.html files with different files that encrypt the site's data with AES-256 encryption, and will also display a warning message on the homepage demanding money along with instructions on how to buy bitcoin.

"Decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the decryption key," says the message. It demands .4 bitcoin to return the website to working order.

View photo

.

This latest iteration of ransomware was discovered by BleepingComputer's Lawrence Abrams. He found that the CTB-Locker even comes with a live chat function, so you can actually message the hacker about paying the ransom, and this version of the ransomware has been signed with stolen certificates.

Related: Ransomware attacks spread like wildfire internationally, threatening schools, churches, and hospitals

Abrams points out in his report that, as per usual, the only way to restore your files other than paying up is to use a back-up.

It appears that there are about a hundred sites infected with CTB-Locker. A Pastebin document has been created that lists many of the sites that appear to have been compromised. No major, big name sites are included.

If you're a website owner who is concerned about this, you should check to make sure that you're using the latest version of WordPress. Most of the sites targeted so far were poorly managed and used outdated versions or had installed vulnerable plug-ins.

CTB-Locker looks like a pretty specialized experiment from the author and it may not be a massive threat in the near future. However, it is the latest mutation of ransomware. We've seen several cases of infections coming up over the last few weeks with businesses and organizations like hospitals and school districts getting infected and paying the ransom.

Also watch: Asus ROG GX700 Hands On Please enable Javascript to watch this video

Apple's top counsel: Our customers are 'better protected from thieves and terrorists'

Ransomware attacks spread like wildfire internationally, threatening schools, churches, and hospitals

Hollywood hospital pays $17,000 to ransomware hackers

Source: CTB-Locker ransomware encrypts WordPress sites and holds them hostage