Crypto Wall v4 Emerges Days After Cyber Threat Alliance Report
Summary: Palo Alto Networks began seeing a new version of CryptoWall, called version 4 by some researchers, on October 30, 2015, less than a week after the Cyber Threat Alliance published a report on the CryptoWall 3 family. The update encrypts filenames as well as file contents, streamlines network communications to reduce HTTP requests, and changes the ransom message, with 10 unique samples and 57 attempted infections observed to date.
Bottom line: Encrypting filenames removes the victim's ability to tell which files were hit, and folding the PNG into the C2 response cuts the network traffic that detection tools relied on - against a family already credited with many millions of dollars in damages worldwide.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026