'Gpcode' is thought to access PCs via unpatched browsers. Once active it encodes most of the data on the computer, including .doc, .txt, .pdf, .xls, .jpg and .png files, with a 1,024-bit key.
Once all the files have been encrypted a ReadMe file is left on the machine giving an email address to send money in order to get the decryption key.
The malware is a revision of a previous virus, thought to be from the same author, which appeared two years ago but only used a 660-bit key.
"Virus researchers have been able to crack keys up to 660 bits," said Timur Tsoriev of Kaspersky Labs.
"This was the result of a detailed analysis of the RSA algorithm implementation. If the encryption algorithm is implemented correctly, it could take one PC with a 2.2GHz processor around 30 years to crack a 660-bit key."
The company has urged users struck by the virus not to reboot or shut down the infected machine.
Instead they should get in contact immediately with the last few websites they visited to determine what, if any, programs were running.
"We urge infected users not to yield to the blackmailer, but to contact us and your local cyber-crime law enforcement units," said Tsoriev. "Yielding to blackmailers only continues the cycle."
Ransomware virus uses 1,024-bit key
Security specialists are warning of a new virus that encrypts data on infected machines and demands money for the decryption key..
Got a news tip for our journalists? Share it with us anonymously here.
SPONSORED RESOURCES
Closing the cyber security execution gap: How IT leaders are building cyber resilience
Tech Skills Report
Rethinking Ransomware Recovery: Closing the Detection and Recovery Gap in Asia Pacific
Strategies to Counter the Ransomware Threat in APJ
Craft your ideal hybrid multicloud strategy
Cloud Resilience Summit
iTnews Benchmark Security Awards 2026
iTnews State of Security Breakfast Sydney
iTnews Executive Retreat - Security Leaders Edition - VIC



