CryLock
CryLock is a ransomware family also referred to in the provided content as Cryakl after a reported rebrand.
Profile source: Mallory opens in a new tabCryLock
Family profile
CryLock is a ransomware family also referred to in the provided content as Cryakl after a reported rebrand. The content states it has operated since roughly 2014/2015 and identifies it as one of the ransomware families whose leaked source code and builders contributed to the creation of later variants. High-confidence reporting in the content links CryLock to a Russian developer who was sentenced by the Brussels criminal court to seven years in prison for developing the malware and leading its deployment on thousands of computers. A female co-conspirator was also reportedly sentenced to five years for advertising the ransomware and negotiating with victims. The content further notes that Belgian authorities detained the pair in Spain in 2023 and extradited them to Belgium, and that law enforcement seized more than €60 million in cryptocurrency tied to proceeds from the CryLock operation. Beyond its classification as ransomware and its large-scale deployment, the provided content does not include specific technical details on encryption behavior, infection vectors, targeted sectors, platforms, or indicators of compromise.
Ransomware.live
Operational record
MITRE ATT&CK
CryLock in ATT&CK
1 distinct techniquesReporting
Research mentioning CryLock
Dark Covenant 3.0: Controlled Impunity and Russia’s Cybercriminals
The majority of the variants originated from leaked source code and builders from existing ransomware families such as LockBit, CryLock, Xorist, Proton, GlobeImposter, Chaos, Makop, MedusaLocker, Djvu, Dharma, and more.
Risky Bulletin: Prisoner hacks prison IT system, goes wild!
"The Financial Times published a profile on a Russian couple that ran the CryLock (Cryakl) ransomware."
⚡ Weekly Recap: Scattered Spider Arrests, Car Exploits, macOS Malware, Fortinet RCE and More
"Law Enforcement Catches Up on Ransomware Actors — The Brussels criminal court sentenced the Russian developer of Crylock ransomware..."
Risky Bulletin: Scattered Spider goes after aviation sector
Belgian authorities have sentenced a Russian man to seven years in prison for developing the CryLock ransomware.
List of ransomware that leaks victims' stolen files if not paid
Operating since 2014/2015, the ransomware known as Cryakl rebranded this year as CryLock.