Exploring the Deep Web

CryptoLockerAnother major malware family that uses the Deep Web is CryptoLocker. CryptoLocker refers to a ransomwarevariant that encrypts victims’ personal documents before redirecting them to a site where they can pay toregain access to their files. CryptoLocker is also smart enough to automatically adjust the payment page toaccount for a victim’s local language and payment means.TorrentLocker—a CryptoLocker variant—makes use of TOR to host payment sites in addition to employingBitcoin as form of payment. It shows why the Deep Web appeals to cybercriminals who are willing to maketheir infrastructures more robust to possible takedowns.The following screenshots are payment pages that the Deep Web Analyzer captured. Both are rendered indifferent languages, giving us an idea of their intended victims and origin.Automatically formatted CryptoLocker pages for victims from Taiwan17 | Below the Surface: Exploring the Deep Web