In the winter of 2009–2010, the screens of millions of computers in Russia were locked by a window demanding an SMS to a premium short number to unlock them. Dr.Web announced January 2010 as a Trojan.Winlock epidemic. In September 2010, Russian police detained 10 people believed to have earned 16 million dollars from the scheme.
Dr.Web estimated losses at about 10 million dollars for January 2010 alone; reports of the arrests put the group’s total earnings at 16 million dollars.
Winlock adds itself to startup. Nothing happens at first.
The user downloads a “codec” or “update” for a video or a program. Winlock installs itself and, after a restart, opens a window covering the whole screen. The window demands an SMS to a premium short number to unlock it; amounts ranged from 300 to 1,000 rubles. The SMS becomes the attacker’s revenue; in most cases no unlock code ever arrives.
Also known as: Trojan.Winlock
The epidemic became visible through a sudden rise in help requests to antivirus vendors. Dr.Web and others published online tools that generated unlock codes for free; mobile operators began shutting down short numbers. Taking payments by SMS made the money trail easier to follow and led to the arrests.
Dr.Web estimated losses at about 10 million dollars for January 2010 alone; reports of the arrests put the group’s total earnings at 16 million dollars. Most victims were in Russia.
Winlock was a small-scale rehearsal of today’s ransomware economy: the lock screen gave way to data encryption, the SMS to cryptocurrency. Today many ransomware attacks begin with corporate session and VPN credentials collected earlier by an infostealer.
Track ransomware groups, victim posts and indicators of compromise, and see the records that match your own assets.
We use cookies to ensure proper operation of our website, analyze usage, and deliver relevant content and advertisements. You can manage your preferences at any time. Cookie Policy