FBI: CryptoWall Ransomware Cost US Users $18 Million

Between April 2014 and June 2015, the CryptoWall ransomware cost Americans over $18 million, according to the FBI's Internet Crime Complaint Center (IC3). The money was spent not only on ransoms, which range from $200 to $10,000 apiece, but also on "network mitigation, network countermeasures, loss of productivity, legal fees, IT services, and/or the purchase of credit monitoring services for employees or customers."

The Bureau calls CryptoWall "the most current and significant ransomware threat targeting U.S. individuals and businesses." Since April 2014, the IC3 received 992 CryptoWall-related complaints. CryptoWall originally took over as top ransomware after its more sophisticated cousin CryptoLocker went down with the GameOver ZeuS botnet last summer.

While costly for victims, ransomware is easy money for criminals. TrustWave researchers estimate that ransomware operators can earn a 1,425 percent return on investment from their activities, even if they only charge a $300 ransom and only 0.5 percent of their victims pay it.

The ransomware industry is also becoming very innovative, both with their technology and business models.

For example, the simply named "Locker" is a "sleeper" cryptoransomware that infected clients, but sat silently until springing into action on May 25. 

Researchers at Intel's McAfee Labs discovered "Tox," a ransomware-as-a-service kit for building and deploying ransomware. It's free to set up and use, but the site hosting Tox takes a 20 percent cut of any ransoms the operators rake in.

Tox and TorrentLocker (a CryptoLocker variant) use the TOR network to host ransom payment sites and accept payment in Bitcoins. The anonymity added by TOR makes it even more difficult to track down the operators of these schemes.

According to Trend Micro global threat communications manager Christopher Budd, ransomware operators have also borrowed a tactic from kidnappers. Similar to showing "proof of life," some ransomware operators will now allow victims to decrypt three files for free, to prove that their data is still intact.

Budd says the pace of innovation in ransomware has increased. "There is, sadly, some very smart thinking going on there."