Update on the Torrentlocker ransomware

Fox-IT provides an update on the TorrentLocker ransomware campaign (Sept–Oct 2014) which uses postal-service-themed phishing to distribute ransomware globally; the report confirms 4,180 infections across 44 countries, documents ~862.7954 BTC (~€257,393) in ransom payments, ~2.6 million harvested email addresses and 1,746 harvested SMTP credentials, lists phishing domains and C2 IPs, and describes persistence (copying executable to Windows or ProgramData and adding registry startup keys).