--- title: CryptoStopper.io Demo – Isolate and Defeat TeslaCrypt Ransomware description: Demonstration illustrating how quickly a server running CrytpoStopper.io can isolate and shut down a workstation after being infected with TeslaCrypt. image: https://blog.canauri.com/hubfs/wpd_cs_vs_teslacrypt21.png --- - [319-383-0165](tel:+1.319-383-0165) - [Free Tools](https://www.getcryptostopper.com/free-tools) - [About](https://www.getcryptostopper.com/about) - [Partners](https://www.getcryptostopper.com/partners) [![CryptoStopper™](https://blog.canauri.com/hubfs/cryptostopper-logo.png)](https://www.getcryptostopper.com/) - [CryptoStopper™](https://www.getcryptostopper.com/cryptostopper/) - [For MSPs](https://www.getcryptostopper.com/cryptostopper-for-msps/) - [Blog](https://blog.getcryptostopper.com/) [Pricing](https://www.getcryptostopper.com/pricing) # CryptoStopper.io Demo – Isolate and Defeat TeslaCrypt Ransomware August 09, 2016 [Chris Hartwig](https://blog.canauri.com/author/chris-hartwig) Today we are going to look at how CryptoStopper.io performs against a malware attack by the dreaded TeslaCrypt ransomware. In this demonstration, I will illustrate how quickly a server running CryptoStopper.io can isolate and shut down a workstation after the workstation has been infected with TeslaCrypt ransomware. From the workstation, I downloaded a copy of the TeslaCrypt variant from virusshare.com. I also installed the server version of CryptoStopper.io onto my Windows Server 2012 R2 box and pointed CryptoStopper.io to monitor the share. **Screenshot 1** This screenshot shows the test environment. The workstation on the left is running Windows 7 Professional and has the ransomware Trojan copied on the desktop. You can see the executable under the Recycle Bin with the long file name. The system to the right is the Windows 2012 R2 server that has CryptoStopper.io installed on it. ![wpd_cs_vs_teslacrypt1.png](https://blog.canauri.com/hs-fs/hubfs/wpd_cs_vs_teslacrypt1.png?width=658&height=207&name=wpd_cs_vs_teslacrypt1.png) **Screenshot 2** I used virustotal.com to validate that the ransomware variant is a legitimate threat and recognized by a large number of antivirus vendors. ![wpd_cs_vs_teslacrypt2.png](https://blog.canauri.com/hs-fs/hubfs/wpd_cs_vs_teslacrypt2.png?width=658&height=411&name=wpd_cs_vs_teslacrypt2.png) **Screenshot 3** This shot shows the running processes on the workstation prior to launching the infection. It also shows that I have a network drive mapped from the server. Once the ransomware attack is initiated from the workstation I expect it to attempt to enumerate the network share and attack the files contained within.![wpd_cs_vs_teslacrypt3.png](https://blog.canauri.com/hs-fs/hubfs/wpd_cs_vs_teslacrypt3.png?width=658&height=411&name=wpd_cs_vs_teslacrypt3.png) **Screenshot 4** In screenshot 4 you can see the share folder on the server and some of the data populated.![wpd_cs_vs_teslacrypt4.png](https://blog.canauri.com/hs-fs/hubfs/wpd_cs_vs_teslacrypt4.png?width=658&height=413&name=wpd_cs_vs_teslacrypt4.png) **Screenshot 5** Cryptostopper.io will use Windows Firewall to isolate an infected workstation. If you look at the “Scope” tab under the CryptoStopper Properties window, you will see there are currently no remote IP addressed being blocked by the firewall.![wpd_cs_vs_teslacrypt5.png](https://blog.canauri.com/hs-fs/hubfs/wpd_cs_vs_teslacrypt5.png?width=658&height=412&name=wpd_cs_vs_teslacrypt5.png) **Screenshot 6** Now that the workstation and the server environment are setup and ready for testing, I will initiate the ransomware attack. I just double-clicked the Trojan executable on the desktop, and I’m being prompted to run the software.![wpd_cs_vs_teslacrypt6.png](https://blog.canauri.com/hs-fs/hubfs/wpd_cs_vs_teslacrypt6.png?width=658&height=411&name=wpd_cs_vs_teslacrypt6.png) **Screenshot 7** After I pressed the run button and gave the workstation permission to launch the ransomware you can see a process launch that matches the name of the ransomware. It is the top process that has the same name as the ransomware executable.![wpd_cs_vs_teslacrypt7.png](https://blog.canauri.com/hs-fs/hubfs/wpd_cs_vs_teslacrypt7.png?width=658&height=411&name=wpd_cs_vs_teslacrypt7.png) **Screenshot 8** Now things start to get interesting. If you look closely at the running processes, you can see the Trojan spawned a child process called cmd.exe \*32. The Trojan is using the command line to start doing its work.![wpd_cs_vs_teslacrypt8.png](https://blog.canauri.com/hs-fs/hubfs/wpd_cs_vs_teslacrypt8.png?width=658&height=409&name=wpd_cs_vs_teslacrypt8.png) **Screenshot 9** Things are heating up. It looks like another child process called Iceeavbtm.exe has kicked off. Right away I notice that the description of the process is suspicious -  “Picnics Pounces Reserves.” These sound like randomly generated words. If you look closely, you will also notice that the ransomware deleted itself from the desktop of the Windows 7 workstation in an attempt to conceal its existence.![wpd_cs_vs_teslacrypt9.png](https://blog.canauri.com/hs-fs/hubfs/wpd_cs_vs_teslacrypt9.png?width=658&height=410&name=wpd_cs_vs_teslacrypt9.png) **Screenshot 10** I was able to quickly right-click the suspicious process and open the file location. There are two files that catch my eye. The first one is the Iceeavbtm.exe application that is running the suspicious process. I also notice another file that has been dropped into the Documents folder named yqwld.exe.![wpd_cs_vs_teslacrypt10.png](https://blog.canauri.com/hs-fs/hubfs/wpd_cs_vs_teslacrypt10.png?width=658&height=412&name=wpd_cs_vs_teslacrypt10.png) **Screenshot 11** In less than 2 minutes of running the Trojan executable, the ransomware demand notices start to appear. You can see under Network Location that three new files have appeared. All are named “recovery+pmiev” and have a file extension of .txt, .png, or .html. It looks like something is trying to get our attention.![wpd_cs_vs_teslacrypt11.png](https://blog.canauri.com/hs-fs/hubfs/wpd_cs_vs_teslacrypt11.png?width=658&height=412&name=wpd_cs_vs_teslacrypt11.png) **Screenshot 12** Screenshot 12 shows that within just a few minutes the ransomware was able to enumerate my network share and attempt to encrypt the data on the share. At this point CryptoStopper.io has recognized the behavior and acted to isolate the workstation by sending a command to shut down and display the message that a ransomware attack has been detected from the workstation.![wpd_cs_vs_teslacrypt12.png](https://blog.canauri.com/hs-fs/hubfs/wpd_cs_vs_teslacrypt12.png?width=658&height=410&name=wpd_cs_vs_teslacrypt12.png) **Screenshot 13** After getting the notification of the workstation shutdown, you can see the isolation of the workstation by reviewing the firewall on the server. As you can see, my workstation IP address of 192.168.15.105 is listed under Remote IP address.![wpd_cs_vs_teslacrypt13.png](https://blog.canauri.com/hs-fs/hubfs/wpd_cs_vs_teslacrypt13.png?width=658&height=413&name=wpd_cs_vs_teslacrypt13.png) **Screenshot 14** A second message popped up on the Windows 7 workstation, notifying the user that the workstation will be shutdown in 2 minutes.![wpd_cs_vs_teslacrypt14.png](https://blog.canauri.com/hs-fs/hubfs/wpd_cs_vs_teslacrypt14.png?width=658&height=411&name=wpd_cs_vs_teslacrypt14.png) **Screenshot 15** I verified the isolation of the workstation by attempting to access my server share. You’ll note that my access to the shared drive has been restricted.![wpd_cs_vs_teslacrypt15.png](https://blog.canauri.com/hs-fs/hubfs/wpd_cs_vs_teslacrypt15.png?width=658&height=413&name=wpd_cs_vs_teslacrypt15.png) **Screenshot 16** Once CryptoStopper.io detected the ransomware attack, I received an email message regarding the shutdown of my workstation. ![wpd_cs_vs_teslacrypt16-1.png](https://blog.canauri.com/hs-fs/hubfs/wpd_cs_vs_teslacrypt16-1.png?width=1024&name=wpd_cs_vs_teslacrypt16-1.png) **Screenshot 17** After attempting to access the share, Windows places a large red X over the drive to let me know access has been denied. I also noticed some pop-up windows that have opened up behind my active window.![wpd_cs_vs_teslacrypt17.png](https://blog.canauri.com/hs-fs/hubfs/wpd_cs_vs_teslacrypt17.png?width=658&height=411&name=wpd_cs_vs_teslacrypt17.png) **Screenshot 18** Here is my Windows 7 workstation displaying the .html, .png, and .txt ransom demand notices that just popped up unexpectedly.![wpd_cs_vs_teslacrypt18.png](https://blog.canauri.com/hs-fs/hubfs/wpd_cs_vs_teslacrypt18.png?width=658&height=412&name=wpd_cs_vs_teslacrypt18.png) **Screenshot 19** The biggest concern with this ransomware attack is how much data did it get on my server? I can verify that information by checking the events file located at C:\\Program Files\\CryptoStopper\\events.csv Examining this file confirms the ransomware attack was not successful. CrytpoStopper.io detected and isolated the workstation quickly and only allowed 12 files to be encrypted on the server.![wpd_cs_vs_teslacrypt19.png](https://blog.canauri.com/hs-fs/hubfs/wpd_cs_vs_teslacrypt19.png?width=658&height=414&name=wpd_cs_vs_teslacrypt19.png) **Screenshot 20** Screenshot 20 contains a shot of the registry showing the modification by TeslaCrypt.![wpd_cs_vs_teslacrypt20.png](https://blog.canauri.com/hs-fs/hubfs/wpd_cs_vs_teslacrypt20.png?width=658&height=414&name=wpd_cs_vs_teslacrypt20.png) As you can see in this demonstration, CryptoStopper.io quickly identified the ransomware attack. CryptoStopper.io identified the attack in real time, isolated the infected workstation and prevented serious damage from occurring on the server. The administrator was notified immediately of the action taken by CryptoStopper.io and given the appropriate information needed to identify and repair the infected workstation. **Network Protection from the Inside-Out** [CryptoStopper.io](https://go.watchpointdata.com/cryptostopper-ransomware-protection) protects business networks from all forms of ransomware, saving money and time resulting from lost or stolen data.  Unlike anti-virus which requires signatures, CryptoStopper is a signature-less system that stops ransomware seconds after it’s started. CryptoStopper gives businesses and techs a way to test the product before buying it with a free trial and a safe ransomware simulation system to test CryptoStopper.     **The Full Ransom Notes** Here are the full ransom notes as they appeared. **This HTML ransom was displayed in my web browser**![wpd_cs_vs_teslacrypt21.png](https://blog.canauri.com/hs-fs/hubfs/wpd_cs_vs_teslacrypt21.png?width=618&height=618&name=wpd_cs_vs_teslacrypt21.png) **The PNG Format Ransom Note![wpd_cs_vs_teslacrypt22.png](https://blog.canauri.com/hs-fs/hubfs/wpd_cs_vs_teslacrypt22.png?width=618&height=537&name=wpd_cs_vs_teslacrypt22.png)** **The TXT Ransom![wpd_cs_vs_teslacrypt23.png](https://blog.canauri.com/hs-fs/hubfs/wpd_cs_vs_teslacrypt23.png?width=658&height=347&name=wpd_cs_vs_teslacrypt23.png)** ### Share this: - [Tweet](https://twitter.com/share) [Previous Post WatchPoint - Tip of the Week - Account Lockout Detection and Notification](https://blog.canauri.com/watchpoint-tip-of-the-week-account-lockout-detection-and-notification) [Next Post Russian Cybergang Hacks Payment System](https://blog.canauri.com/russian-cybergang-hacks-payment-system) [![Entrepreneur Link](https://blog.canauri.com/hs-fs/hubfs/Watch_Point_Data_December2017_Theme/images/Feature-on-Entrepreneur.com_.png?width=300&height=300&name=Feature-on-Entrepreneur.com_.png)](https://www.entrepreneur.com/article/286698) ### Share [![Share on Facebook](https://static.hubspot.com/final/img/common/icons/social/facebook-24x24.png)](http://www.facebook.com/share.php?u=https%3A%2F%2Fblog.canauri.com%2Fcryptostopper.io-demo-containing-and-defeating-teslacrypt-ransomware%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on LinkedIn](https://static.hubspot.com/final/img/common/icons/social/linkedin-24x24.png)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fblog.canauri.com%2Fcryptostopper.io-demo-containing-and-defeating-teslacrypt-ransomware%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on Twitter](https://static.hubspot.com/final/img/common/icons/social/twitter-24x24.png)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fblog.canauri.com%2Fcryptostopper.io-demo-containing-and-defeating-teslacrypt-ransomware%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fblog.canauri.com%2Fcryptostopper.io-demo-containing-and-defeating-teslacrypt-ransomware%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=CryptoStopper.io%20Demo%20%E2%80%93%20Isolate%20and%20Defeat%20TeslaCrypt%20Ransomware) [![Share on Pinterest](https://static.hubspot.com/final/img/common/icons/social/pinterest-24x24.png)](http://pinterest.com/pin/create/button/?url=https%3A%2F%2Fblog.canauri.com%2Fcryptostopper.io-demo-containing-and-defeating-teslacrypt-ransomware%3Futm_medium%3Dsocial%26utm_source%3Dpinterest&media=) [![Share on Email](https://static.hubspot.com/final/img/common/icons/social/email-24x24.png)](mailto:?subject=Check%20out%20https%3A%2F%2Fblog.canauri.com%2Fcryptostopper.io-demo-containing-and-defeating-teslacrypt-ransomware%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fblog.canauri.com%2Fcryptostopper.io-demo-containing-and-defeating-teslacrypt-ransomware%3Futm_medium%3Dsocial%26utm_source%3Demail) ### Subscribe to Email Updates ### Recent Posts ### Posts by Topic - [Cyber Threats (164)](https://blog.canauri.com/topic/cyber-threats) - [Ransomware (91)](https://blog.canauri.com/topic/ransomware) - [Data Breach (68)](https://blog.canauri.com/topic/data-breach) - [Business (49)](https://blog.canauri.com/topic/business) - [Scams (19)](https://blog.canauri.com/topic/scams) - [cybersecurity (14)](https://blog.canauri.com/topic/cybersecurity) - [Cyber Attack (10)](https://blog.canauri.com/topic/cyber-attack) - [Uncategorized (9)](https://blog.canauri.com/topic/uncategorized) - [Breach (8)](https://blog.canauri.com/topic/breach) - [Data (8)](https://blog.canauri.com/topic/data) - [Phishing (7)](https://blog.canauri.com/topic/phishing) - [cyber (5)](https://blog.canauri.com/topic/cyber) - [decrypters (5)](https://blog.canauri.com/topic/decrypters) - [security (5)](https://blog.canauri.com/topic/security) - [Insider (4)](https://blog.canauri.com/topic/insider) - [Ransomware Decrypters (4)](https://blog.canauri.com/topic/ransomware-decrypters) - [cybercrime (4)](https://blog.canauri.com/topic/cybercrime) - [managed service providers (4)](https://blog.canauri.com/topic/managed-service-providers) - [ransom (4)](https://blog.canauri.com/topic/ransom) - [ransomware ransom (4)](https://blog.canauri.com/topic/ransomware-ransom) - [Banking Trojans (3)](https://blog.canauri.com/topic/banking-trojans) - [Firewalls (3)](https://blog.canauri.com/topic/firewalls) - [Press Release (3)](https://blog.canauri.com/topic/press-release) - [Ransomware as a Service (3)](https://blog.canauri.com/topic/ransomware-as-a-service) - [WannaCry (3)](https://blog.canauri.com/topic/wannacry) - [Zero Day Vulnerability (3)](https://blog.canauri.com/topic/zero-day-vulnerability) - [business email compromise (3)](https://blog.canauri.com/topic/business-email-compromise) - [cyber security (3)](https://blog.canauri.com/topic/cyber-security) - [decryptors (3)](https://blog.canauri.com/topic/decryptors) - [ransomware attack (3)](https://blog.canauri.com/topic/ransomware-attack) - [BlueKeep (2)](https://blog.canauri.com/topic/bluekeep) - [CEO fraud (2)](https://blog.canauri.com/topic/ceo-fraud) - [COVID-19 (2)](https://blog.canauri.com/topic/covid-19) - [COVID-19 cybersecurity (2)](https://blog.canauri.com/topic/covid-19-cybersecurity) - [Cyberattack (2)](https://blog.canauri.com/topic/cyberattack) - [Fileless (2)](https://blog.canauri.com/topic/fileless) - [Fileless Malware (2)](https://blog.canauri.com/topic/fileless-malware) - [Fileless Ransomare (2)](https://blog.canauri.com/topic/fileless-ransomare) - [Fortnite vulnerability (2)](https://blog.canauri.com/topic/fortnite-vulnerability) - [MSPs (2)](https://blog.canauri.com/topic/msps) - [Patch (2)](https://blog.canauri.com/topic/patch) - [Small and Medium Enterprises Cybersecurity (2)](https://blog.canauri.com/topic/small-and-medium-enterprises-cybersecurity) - [Spear Phishing (2)](https://blog.canauri.com/topic/spear-phishing) - [WFH (2)](https://blog.canauri.com/topic/wfh) - [Wi-Fi Connections (2)](https://blog.canauri.com/topic/wi-fi-connections) - [Zero Day (2)](https://blog.canauri.com/topic/zero-day) - [Zero Day Attacks (2)](https://blog.canauri.com/topic/zero-day-attacks) - [bitcoin (2)](https://blog.canauri.com/topic/bitcoin) - [bitcoins (2)](https://blog.canauri.com/topic/bitcoins) - [cryptocurrency (2)](https://blog.canauri.com/topic/cryptocurrency) - [cryptocurrency mining (2)](https://blog.canauri.com/topic/cryptocurrency-mining) - [cryptojacking (2)](https://blog.canauri.com/topic/cryptojacking) - [cyber attacks on hospitals (2)](https://blog.canauri.com/topic/cyber-attacks-on-hospitals) - [cybersecurity jobs (2)](https://blog.canauri.com/topic/cybersecurity-jobs) - [defray (2)](https://blog.canauri.com/topic/defray) - [defray ransomware (2)](https://blog.canauri.com/topic/defray-ransomware) - [fortnite (2)](https://blog.canauri.com/topic/fortnite) - [gandcrab ransomware (2)](https://blog.canauri.com/topic/gandcrab-ransomware) - [hacking (2)](https://blog.canauri.com/topic/hacking) - [health (2)](https://blog.canauri.com/topic/health) - [healthcare (2)](https://blog.canauri.com/topic/healthcare) - [hospital cybersecurity (2)](https://blog.canauri.com/topic/hospital-cybersecurity) - [mac malware (2)](https://blog.canauri.com/topic/mac-malware) - [municipalities cyberattack (2)](https://blog.canauri.com/topic/municipalities-cyberattack) - [municipalities ransomware (2)](https://blog.canauri.com/topic/municipalities-ransomware) - [passwords (2)](https://blog.canauri.com/topic/passwords) - [ransomware attacks (2)](https://blog.canauri.com/topic/ransomware-attacks) - [ransomware normal (2)](https://blog.canauri.com/topic/ransomware-normal) - [scareware (2)](https://blog.canauri.com/topic/scareware) - [two-factor authentication (2)](https://blog.canauri.com/topic/two-factor-authentication) - [2018 cybersecurity (1)](https://blog.canauri.com/topic/2018-cybersecurity) - [2018 cybersecurity review (1)](https://blog.canauri.com/topic/2018-cybersecurity-review) - [2019 cybersecurity predictions (1)](https://blog.canauri.com/topic/2019-cybersecurity-predictions) - [2019 predictions (1)](https://blog.canauri.com/topic/2019-predictions) - [2020 Cybersecurity Predictions (1)](https://blog.canauri.com/topic/2020-cybersecurity-predictions) - [2FA (1)](https://blog.canauri.com/topic/2fa) - [Arizona (1)](https://blog.canauri.com/topic/arizona) - [Arizona beverages ransomware (1)](https://blog.canauri.com/topic/arizona-beverages-ransomware) - [BEC (1)](https://blog.canauri.com/topic/bec) - [BEC Attacks (1)](https://blog.canauri.com/topic/bec-attacks) - [BitPaymer (1)](https://blog.canauri.com/topic/bitpaymer) - [BlueKeep Exploit (1)](https://blog.canauri.com/topic/bluekeep-exploit) - [BlueKeep Vulnerability (1)](https://blog.canauri.com/topic/bluekeep-vulnerability) - [CISO (1)](https://blog.canauri.com/topic/ciso) - [Chief Information Security Officer (1)](https://blog.canauri.com/topic/chief-information-security-officer) - [Coronavirus (1)](https://blog.canauri.com/topic/coronavirus) - [Coronavirus scams (1)](https://blog.canauri.com/topic/coronavirus-scams) - [CryptoMix (1)](https://blog.canauri.com/topic/cryptomix) - [Cyber Liability Insurance (1)](https://blog.canauri.com/topic/cyber-liability-insurance) - [DLL (1)](https://blog.canauri.com/topic/dll) - [DLL CryptoMix (1)](https://blog.canauri.com/topic/dll-cryptomix) - [Data Leak (1)](https://blog.canauri.com/topic/data-leak) - [Deepfakes (1)](https://blog.canauri.com/topic/deepfakes) - [Dridex (1)](https://blog.canauri.com/topic/dridex) - [ERP (1)](https://blog.canauri.com/topic/erp) - [ERP Systems (1)](https://blog.canauri.com/topic/erp-systems) - [Enterprise Resource Planning (1)](https://blog.canauri.com/topic/enterprise-resource-planning) - [Exactis (1)](https://blog.canauri.com/topic/exactis) - [FIFA (1)](https://blog.canauri.com/topic/fifa) - [Fortnite ransomware (1)](https://blog.canauri.com/topic/fortnite-ransomware) - [GandCrab (1)](https://blog.canauri.com/topic/gandcrab) - [Google (1)](https://blog.canauri.com/topic/google) - [Have I been pwned (1)](https://blog.canauri.com/topic/have-i-been-pwned) - [Hospitals Ransomware (1)](https://blog.canauri.com/topic/hospitals-ransomware) - [Kirk (1)](https://blog.canauri.com/topic/kirk) - [Kirk Ransomware (1)](https://blog.canauri.com/topic/kirk-ransomware) - [LockBit (1)](https://blog.canauri.com/topic/lockbit) - [LockerGoga (1)](https://blog.canauri.com/topic/lockergoga) - [LockerGoga Ransomware (1)](https://blog.canauri.com/topic/lockergoga-ransomware) - [M&A (1)](https://blog.canauri.com/topic/ma) - [Malware (1)](https://blog.canauri.com/topic/malware) - [Marriott data breach (1)](https://blog.canauri.com/topic/marriott-data-breach) - [NASA (1)](https://blog.canauri.com/topic/nasa) - [NASA Data Breach (1)](https://blog.canauri.com/topic/nasa-data-breach) - [NCSAM (1)](https://blog.canauri.com/topic/ncsam) - [National Cyber Security Awareness Month (1)](https://blog.canauri.com/topic/national-cyber-security-awareness-month) - [Norsk (1)](https://blog.canauri.com/topic/norsk) - [Norsk Hydro (1)](https://blog.canauri.com/topic/norsk-hydro) - [PGA (1)](https://blog.canauri.com/topic/pga) - [Patch Tuesday (1)](https://blog.canauri.com/topic/patch-tuesday) - [Petya (1)](https://blog.canauri.com/topic/petya) - [Petya Ransomware (1)](https://blog.canauri.com/topic/petya-ransomware) - [Quora data breach (1)](https://blog.canauri.com/topic/quora-data-breach) - [RDP (1)](https://blog.canauri.com/topic/rdp) - [Remote Desktop Protocol (1)](https://blog.canauri.com/topic/remote-desktop-protocol) - [Remote workforce (1)](https://blog.canauri.com/topic/remote-workforce) - [RobbinHood Ransomware (1)](https://blog.canauri.com/topic/robbinhood-ransomware) - [Robbinhood (1)](https://blog.canauri.com/topic/robbinhood) - [SEC (1)](https://blog.canauri.com/topic/sec) - [SME (1)](https://blog.canauri.com/topic/sme) - [SME Cybersecurity (1)](https://blog.canauri.com/topic/sme-cybersecurity) - [SamSam (1)](https://blog.canauri.com/topic/samsam) - [SamSam Ransomware (1)](https://blog.canauri.com/topic/samsam-ransomware) - [Security Breach Notification Laws (1)](https://blog.canauri.com/topic/security-breach-notification-laws) - [Small and Medium Enterprises (1)](https://blog.canauri.com/topic/small-and-medium-enterprises) - [Sorebrect (1)](https://blog.canauri.com/topic/sorebrect) - [Star Trek (1)](https://blog.canauri.com/topic/star-trek) - [Syrk ransomware (1)](https://blog.canauri.com/topic/syrk-ransomware) - [Target (1)](https://blog.canauri.com/topic/target) - [Vidar (1)](https://blog.canauri.com/topic/vidar) - [Vidar infostealer (1)](https://blog.canauri.com/topic/vidar-infostealer) - [Vidar trojan (1)](https://blog.canauri.com/topic/vidar-trojan) - [WCry (1)](https://blog.canauri.com/topic/wcry) - [Wana Decryptor (1)](https://blog.canauri.com/topic/wana-decryptor) - [WanaCry (1)](https://blog.canauri.com/topic/wanacry) - [WanaDecryptor (1)](https://blog.canauri.com/topic/wanadecryptor) - [WannaCry 2.0 (1)](https://blog.canauri.com/topic/wannacry-2-0) - [World Cup (1)](https://blog.canauri.com/topic/world-cup) - [Yahoo (1)](https://blog.canauri.com/topic/yahoo) - [Yahoo Data Breach (1)](https://blog.canauri.com/topic/yahoo-data-breach) - [anatova (1)](https://blog.canauri.com/topic/anatova) - [anatova ransomware (1)](https://blog.canauri.com/topic/anatova-ransomware) - [arizona beverages (1)](https://blog.canauri.com/topic/arizona-beverages) - [atlanta (1)](https://blog.canauri.com/topic/atlanta) - [automobile (1)](https://blog.canauri.com/topic/automobile) - [automobile hacking (1)](https://blog.canauri.com/topic/automobile-hacking) - [azorult trojan (1)](https://blog.canauri.com/topic/azorult-trojan) - [banking trojan (1)](https://blog.canauri.com/topic/banking-trojan) - [bentley (1)](https://blog.canauri.com/topic/bentley) - [bitpaymer ransomware (1)](https://blog.canauri.com/topic/bitpaymer-ransomware) - [blackmail (1)](https://blog.canauri.com/topic/blackmail) - [budgeting (1)](https://blog.canauri.com/topic/budgeting) - [capital one (1)](https://blog.canauri.com/topic/capital-one) - [capital one data breach (1)](https://blog.canauri.com/topic/capital-one-data-breach) - [car hacking (1)](https://blog.canauri.com/topic/car-hacking) - [care (1)](https://blog.canauri.com/topic/care) - [chicago tribune (1)](https://blog.canauri.com/topic/chicago-tribune) - [collection (1)](https://blog.canauri.com/topic/collection) - [collection 1 (1)](https://blog.canauri.com/topic/collection-1) - [coronavirus cybersecurity (1)](https://blog.canauri.com/topic/coronavirus-cybersecurity) - [coronavirus phishing (1)](https://blog.canauri.com/topic/coronavirus-phishing) - [coronavirus ransomware (1)](https://blog.canauri.com/topic/coronavirus-ransomware) - [crypto (1)](https://blog.canauri.com/topic/crypto) - [crytocurrency hack (1)](https://blog.canauri.com/topic/crytocurrency-hack) - [currency (1)](https://blog.canauri.com/topic/currency) - [cyber insurance (1)](https://blog.canauri.com/topic/cyber-insurance) - [cybersecurity budgeting (1)](https://blog.canauri.com/topic/cybersecurity-budgeting) - [cybersecurity coronavirus (1)](https://blog.canauri.com/topic/cybersecurity-coronavirus) - [cybersecurity predictions (1)](https://blog.canauri.com/topic/cybersecurity-predictions) - [cybersecurity ventures (1)](https://blog.canauri.com/topic/cybersecurity-ventures) - [cybersecurity working remotely (1)](https://blog.canauri.com/topic/cybersecurity-working-remotely) - [dharma (1)](https://blog.canauri.com/topic/dharma) - [dharma ransomware (1)](https://blog.canauri.com/topic/dharma-ransomware) - [financial services (1)](https://blog.canauri.com/topic/financial-services) - [financial services data breach (1)](https://blog.canauri.com/topic/financial-services-data-breach) - [government cyberattack (1)](https://blog.canauri.com/topic/government-cyberattack) - [holiday shopping (1)](https://blog.canauri.com/topic/holiday-shopping) - [hospitals hit with ransomware (1)](https://blog.canauri.com/topic/hospitals-hit-with-ransomware) - [iEncrypt (1)](https://blog.canauri.com/topic/iencrypt) - [insider trading (1)](https://blog.canauri.com/topic/insider-trading) - [insurance (1)](https://blog.canauri.com/topic/insurance) - [laundering (1)](https://blog.canauri.com/topic/laundering) - [leak (1)](https://blog.canauri.com/topic/leak) - [los angeles times (1)](https://blog.canauri.com/topic/los-angeles-times) - [man in the disk (1)](https://blog.canauri.com/topic/man-in-the-disk) - [man in the disk attacks (1)](https://blog.canauri.com/topic/man-in-the-disk-attacks) - [maritime cybersecurity (1)](https://blog.canauri.com/topic/maritime-cybersecurity) - [maze ransomware (1)](https://blog.canauri.com/topic/maze-ransomware) - [pensacola florida (1)](https://blog.canauri.com/topic/pensacola-florida) - [phobos (1)](https://blog.canauri.com/topic/phobos) - [phobos ransomware (1)](https://blog.canauri.com/topic/phobos-ransomware) - [quarter 1 2019 ransomware (1)](https://blog.canauri.com/topic/quarter-1-2019-ransomware) - [raccoon stealer (1)](https://blog.canauri.com/topic/raccoon-stealer) - [ransomware data breaches (1)](https://blog.canauri.com/topic/ransomware-data-breaches) - [ransomware defined (1)](https://blog.canauri.com/topic/ransomware-defined) - [ransomware epidemic (1)](https://blog.canauri.com/topic/ransomware-epidemic) - [ransomware hits municipalities (1)](https://blog.canauri.com/topic/ransomware-hits-municipalities) - [ransomware statistics (1)](https://blog.canauri.com/topic/ransomware-statistics) - [riviera beach ransomware attack (1)](https://blog.canauri.com/topic/riviera-beach-ransomware-attack) - [ryuk (1)](https://blog.canauri.com/topic/ryuk) - [ryuk ransomware (1)](https://blog.canauri.com/topic/ryuk-ransomware) - [scammers (1)](https://blog.canauri.com/topic/scammers) - [scams targeting holiday shoppers (1)](https://blog.canauri.com/topic/scams-targeting-holiday-shoppers) - [securities and exchange commission (1)](https://blog.canauri.com/topic/securities-and-exchange-commission) - [sextortion (1)](https://blog.canauri.com/topic/sextortion) - [shipping industry (1)](https://blog.canauri.com/topic/shipping-industry) - [snake ransomware (1)](https://blog.canauri.com/topic/snake-ransomware) - [social engineering (1)](https://blog.canauri.com/topic/social-engineering) - [southwire (1)](https://blog.canauri.com/topic/southwire) - [stop paying the ransom (1)](https://blog.canauri.com/topic/stop-paying-the-ransom) - [tips for working remotely (1)](https://blog.canauri.com/topic/tips-for-working-remotely) - [tribune (1)](https://blog.canauri.com/topic/tribune) - [ursnif (1)](https://blog.canauri.com/topic/ursnif) - [wall street journal (1)](https://blog.canauri.com/topic/wall-street-journal) - [what is ransomware (1)](https://blog.canauri.com/topic/what-is-ransomware) - [working from home (1)](https://blog.canauri.com/topic/working-from-home) - [working remotely (1)](https://blog.canauri.com/topic/working-remotely) see all ##### Contact [415 12th Ave SE, Suite 201 Cedar Rapids, IA 52401](https://www.google.com/maps/place/415+12th+Ave+SE+%23201,+Cedar+Rapids,+IA+52401/@41.9710436,-91.6582952,17z/data=!3m1!4b1!4m5!3m4!1s0x87e4f73f67891f6d:0x38f71e45a9fa7c1f!8m2!3d41.9710436!4d-91.6561065) [319-383-0165](tel:319-383-0165) [support@getcryptostopper.com](mailto:support@getcryptostopper.com) Facebook Twitter Linkedin YouTube - Products - [CryptoStopper™](https://www.getcryptostopper.com/cryptostopper/) - [Endpoint Security](https://www.getcryptostopper.com/tools/endpoint-security/) - Free Tools - [Ransomware Simulator](https://www.getcryptostopper.com/ransomware-simulator/) - [Network Tools](https://www.getcryptostopper.com/free-network-tools/) - [Ransomware Decryptors](https://www.getcryptostopper.com/ransomware-decryptors/) - Company - [About](https://www.getcryptostopper.com/about/) - [Careers](https://www.getcryptostopper.com/careers/) - [Contact](https://www.getcryptostopper.com/contact/) © Copyright WatchPoint Data, All Rights Reserved   |   [Terms](https://www.getcryptostopper.com/terms)