--- title: Tip of the Week – A Free Tool For Testing Anti-Ransomware Defenses description: Simulate a ransomware attack. Use two PowerShell scripts to simulate a ransomware attack. One script to encrypt the data and another to decrypt the data. image: https://blog.canauri.com/hubfs/Logo/watchpoint_css.png --- - [319-383-0165](tel:+1.319-383-0165) - [Free Tools](https://www.getcryptostopper.com/free-tools) - [About](https://www.getcryptostopper.com/about) - [Partners](https://www.getcryptostopper.com/partners) [![CryptoStopper™](https://blog.canauri.com/hubfs/cryptostopper-logo.png)](https://www.getcryptostopper.com/) - [CryptoStopper™](https://www.getcryptostopper.com/cryptostopper/) - [For MSPs](https://www.getcryptostopper.com/cryptostopper-for-msps/) - [Blog](https://blog.getcryptostopper.com/) [Pricing](https://www.getcryptostopper.com/pricing) # Tip of the Week – A Free Tool For Testing Anti-Ransomware Defenses October 18, 2016 [Nathan Studebaker](https://blog.canauri.com/author/nathan-studebaker) ![encryption\_output.png](https://blog.canauri.com/hs-fs/hubfs/tip_of_the_week/encryption_output.png?width=573&height=252&name=encryption_output.png) We have written two PowerShell scripts that function just like ransomware. One script encrypts the data, and the other script decrypts the data using a public/private key pair. We created these as a tool so that you can test your defenses against actual ransomware. The purpose of the decrypter is to ensure that your files aren't permanently destroyed.  Here is an overview of how it works. ###USE AT YOUR OWN RISK - THESE SCRIPTS ARE PROVIDED FREE OF CHARGE - WATCHPOINT DOES NOT PROVIDE SUPPORT FOR THESE SCRIPTS. THIS IS A FREE TOOL FOR TESTING PURPOSES ONLY. DO NOT RUN IN A PRODUCTION ENVIRONMENT.### [![Get access to the PowerShell Encrypter/Decrypter](https://hubspot-no-cache-na2-prod.s3.amazonaws.com/cta/default/604281/8d29d3ec-c2f6-4ab8-99df-a2fe864fd9a5.png)](https://hubspot-cta-redirect-na2-prod.s3.amazonaws.com/cta/redirect/604281/8d29d3ec-c2f6-4ab8-99df-a2fe864fd9a5) - The network drives are enumerated and sorted in descending order. - The lowest drive letter will be attacked. This gives you the ability to control what shares are affected. In my testing environments, I use the drive letter Z as my ‘attack’ drive. - All files are discovered. Only files are discovered, folders are excluded. - Each file is encrypted with the Public key of our certificate. You will need a certificate for this to work and I’ve included all the necessary steps below. - After all of the files have been encrypted, the script exits. The decryption script does the same thing, except that it decrypts files instead of encrypting them. The script also makes a copy of every file before it encrypts them. It stores the copy in env:temp. It should go without saying, but please make sure you have a good backup before running this simulation, as the files will be encrypted. Make sure that you have permission. WatchPoint is not responisble for any outcome of running these scripts. If you know what you're doing then it's safe, if not then please don't do it!   Here are the steps to run the ransomware simulation: **The Environment:** - Workgroups are not supported, so you must have a functional windows domain. - CryptoStopper is a server based application. To run the simulation you'll need a Windows server and a Windows workstation. Again, both on the same domain. - Two user accounts. Separate user accounts should be used on the workstation and the server.  - A folder and some files. Ideally, in addition to a shared folder, the target share will contain at least one folder and some target files. Populating the share with some dummy files will more closely simulate a real environment and make for a better test. Within the zip file you'll find a random file generator script. You can use it to populate your share with data. - When testing the PowerShell script against CryptoStopper, be sure to select the entire shared folder. One advantage of using CryptoStopper is that it provides unavoidable protection for the network share. By selecting the root of the share, and all of the subfolders, you're setting an unavoidable trap for ransomware. **The simulation:** As mentioned previously, you’re going to need a test computer from which to run the simulation. In my example, I am using a Windows 8 computer, but Windows 7 and Windows 10 will work just fine. 1. Make sure that you have a good backup. 2. Double check that you do indeed have a good backup. 3. Before we can run the script, we have to provide it a certificate to use. The certificate is identified by its unique thumbprint. Here are the steps to get that thumbprint. 1. To check if the computer has a certificate installed, open PowerShell as an administrator. 2. Enter the following command: Get-childitem cert:\\currentuser\\my ![get-childitem\_cert.png](https://blog.canauri.com/hs-fs/hubfs/tip_of_the_week/get-childitem_cert.png?width=386&height=15&name=get-childitem_cert.png) c. If you have already have a certificate, then you’ll see output similar to the one below. If so, proceed to step 4. Otherwise keep following the steps to create a certificate. ![thumbprint.png](https://blog.canauri.com/hs-fs/hubfs/tip_of_the_week/thumbprint.png?width=548&height=70&name=thumbprint.png) d. Follow these steps if you don’t have a certificate. i. Open mmc.exe. ii. File \> Add/Remove Snap-In \> Certificates \> My user account \> Finish \> Ok. ![add\_certificate.png](https://blog.canauri.com/hs-fs/hubfs/tip_of_the_week/add_certificate.png?width=469&name=add_certificate.png) iii. Expand certificates \> Personal \> Certificates. ![certs\_expanded.png](https://blog.canauri.com/hs-fs/hubfs/tip_of_the_week/certs_expanded.png?width=165&height=77&name=certs_expanded.png) iv. All tasks \> request new certificate. v. Next \> Next at Active Directory Enrollment \> vi. Checkbox for User \> Enroll ![enroll\_cert.png](https://blog.canauri.com/hs-fs/hubfs/tip_of_the_week/enroll_cert.png?width=477&name=enroll_cert.png)vii. Now, let's check for the thumbprint again. From an admin PowerShell prompt type; get-childitem cert:\\currentuser\\my ![get-childitem\_cert.png](https://blog.canauri.com/hs-fs/hubfs/tip_of_the_week/get-childitem_cert.png?width=386&height=15&name=get-childitem_cert.png) viii. You should see output similar to this: ![thumbprint2.png](https://blog.canauri.com/hs-fs/hubfs/tip_of_the_week/thumbprint2.png?width=551&height=88&name=thumbprint2.png) 4\. Now we need to copy the thumbprint id so we can use it in both the encryption and decryption script. 5\. Copy the thumbprint id to the PowerShell scripts, see below: **Before:** **![thumbprint\_in\_script.png](https://blog.canauri.com/hs-fs/hubfs/tip_of_the_week/thumbprint_in_script.png?width=568&height=48&name=thumbprint_in_script.png)** **After:** **![thumbprint\_in\_script2.png](https://blog.canauri.com/hs-fs/hubfs/tip_of_the_week/thumbprint_in_script2.png?width=568&height=37&name=thumbprint_in_script2.png)** 6. Next, map a drive to the server share that we want to run the simulated attack against. It’s important to know that the PowerShell scripts attack the lowest drive letter. I always map the Z: drive to the share that I am testing. ![mapped\_drive.png](https://blog.canauri.com/hs-fs/hubfs/tip_of_the_week/mapped_drive.png?width=329&height=107&name=mapped_drive.png)7. Now let’s create a test file on the Z: drive and enter some text. This text should be encrypted after we run our test. ![cleartext\_file.png](https://blog.canauri.com/hs-fs/hubfs/tip_of_the_week/cleartext_file.png?width=455&height=105&name=cleartext_file.png) 8\. It’s time to run the PowerShell ransomware/encryption script. Right click and select ‘Run with PowerShell.' ![run\_script.png](https://blog.canauri.com/hs-fs/hubfs/tip_of_the_week/run_script.png?width=271&height=60&name=run_script.png) 9. You should immediately start seeing output like this: ![encryption\_output.png](https://blog.canauri.com/hs-fs/hubfs/tip_of_the_week/encryption_output.png?width=573&height=252&name=encryption_output.png) 10. Now let’s check our plain text file. As you’ll see it’s not clear-text anymore, which means the encryption worked!  But did our defenses work? Only you can answer that question, but if you had [CryptoStopper](https://go.watchpointdata.com/cryptostopper-ransomware-protection), then it definitely did! ![encrypted\_file.png](https://blog.canauri.com/hs-fs/hubfs/tip_of_the_week/encrypted_file.png?width=628&height=109&name=encrypted_file.png) 11. Next we use the decrypt, to decrypt our files. Just like before, right-click and select ‘Run with PowerShell.' ![run\_decrypt\_script.png](https://blog.canauri.com/hs-fs/hubfs/tip_of_the_week/run_decrypt_script.png?width=282&height=59&name=run_decrypt_script.png) 12. Presto! The original file is back! ![cleartext\_file.png](https://blog.canauri.com/hs-fs/hubfs/tip_of_the_week/cleartext_file.png?width=455&height=105&name=cleartext_file.png) On a side note, and as I mentioned earlier, the script makes a copy of every file it encrypts to the env:temp directory, aka C:\\users\\username\\AppData\\Local\\Temp. So if you didn’t heed the warnings in steps 1 and 2, then you can check this directory for a copy of the files, just in case the decryption didn’t work. ![temp\_dir.png](https://blog.canauri.com/hs-fs/hubfs/tip_of_the_week/temp_dir.png?width=573&name=temp_dir.png) That’s it. You now have a simple and effective way to test the security of your network against a simulated ransomware attack. And because we have the decrypter, you can undo the affects of the ransomware attack. Feel free to put [CryptoStopper](https://go.watchpointdata.com/cryptostopper-ransomware-protection) to the test by downloading a free trial.   ###USE AT YOUR OWN RISK - THESE SCRIPTS ARE PROVIDED FREE OF CHARGE - WATCHPOINT DOES NOT PROVIDE SUPPORT FOR THESE SCRIPTS. THIS IS A FREE TOOL FOR TESTING PURPOSES ONLY. DO NOT RUN IN A PRODUCTION ENVIRONMENT.### [![Get access to the PowerShell Encrypter/Decrypter](https://hubspot-no-cache-na2-prod.s3.amazonaws.com/cta/default/604281/8d29d3ec-c2f6-4ab8-99df-a2fe864fd9a5.png)](https://hubspot-cta-redirect-na2-prod.s3.amazonaws.com/cta/redirect/604281/8d29d3ec-c2f6-4ab8-99df-a2fe864fd9a5)   ### Share this: - [Tweet](https://twitter.com/share) [Previous Post How to Check if You've Been Affected by the Yahoo Hack](https://blog.canauri.com/how-to-check-if-youve-been-affected-by-the-yahoo-hack) [Next Post How a Popular Bitcoin Site Could Have Prevented The Attack on Their Site](https://blog.canauri.com/how-a-popular-bitcoin-site-could-have-prevented-the-attack-on-their-site) [![Entrepreneur Link](https://blog.canauri.com/hs-fs/hubfs/Watch_Point_Data_December2017_Theme/images/Feature-on-Entrepreneur.com_.png?width=300&height=300&name=Feature-on-Entrepreneur.com_.png)](https://www.entrepreneur.com/article/286698) ### Share [![Share on Facebook](https://static.hubspot.com/final/img/common/icons/social/facebook-24x24.png)](http://www.facebook.com/share.php?u=https%3A%2F%2Fblog.canauri.com%2Fwatchpoint-tip-of-the-week-a-free-tool-for-simulating-ransomware-attacks%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on LinkedIn](https://static.hubspot.com/final/img/common/icons/social/linkedin-24x24.png)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fblog.canauri.com%2Fwatchpoint-tip-of-the-week-a-free-tool-for-simulating-ransomware-attacks%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on Twitter](https://static.hubspot.com/final/img/common/icons/social/twitter-24x24.png)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fblog.canauri.com%2Fwatchpoint-tip-of-the-week-a-free-tool-for-simulating-ransomware-attacks%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fblog.canauri.com%2Fwatchpoint-tip-of-the-week-a-free-tool-for-simulating-ransomware-attacks%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=Tip%20of%20the%20Week%20%E2%80%93%20A%20Free%20Tool%20For%20Testing%20Anti-Ransomware%20Defenses) [![Share on Pinterest](https://static.hubspot.com/final/img/common/icons/social/pinterest-24x24.png)](http://pinterest.com/pin/create/button/?url=https%3A%2F%2Fblog.canauri.com%2Fwatchpoint-tip-of-the-week-a-free-tool-for-simulating-ransomware-attacks%3Futm_medium%3Dsocial%26utm_source%3Dpinterest&media=) [![Share on Email](https://static.hubspot.com/final/img/common/icons/social/email-24x24.png)](mailto:?subject=Check%20out%20https%3A%2F%2Fblog.canauri.com%2Fwatchpoint-tip-of-the-week-a-free-tool-for-simulating-ransomware-attacks%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fblog.canauri.com%2Fwatchpoint-tip-of-the-week-a-free-tool-for-simulating-ransomware-attacks%3Futm_medium%3Dsocial%26utm_source%3Demail) ### Subscribe to Email Updates ### Recent Posts ### Posts by Topic - [Cyber Threats (164)](https://blog.canauri.com/topic/cyber-threats) - [Ransomware (91)](https://blog.canauri.com/topic/ransomware) - [Data Breach (68)](https://blog.canauri.com/topic/data-breach) - [Business (49)](https://blog.canauri.com/topic/business) - [Scams (19)](https://blog.canauri.com/topic/scams) - [cybersecurity (14)](https://blog.canauri.com/topic/cybersecurity) - [Cyber Attack (10)](https://blog.canauri.com/topic/cyber-attack) - [Uncategorized (9)](https://blog.canauri.com/topic/uncategorized) - [Breach (8)](https://blog.canauri.com/topic/breach) - [Data (8)](https://blog.canauri.com/topic/data) - [Phishing (7)](https://blog.canauri.com/topic/phishing) - [cyber (5)](https://blog.canauri.com/topic/cyber) - [decrypters (5)](https://blog.canauri.com/topic/decrypters) - [security (5)](https://blog.canauri.com/topic/security) - [Insider (4)](https://blog.canauri.com/topic/insider) - [Ransomware Decrypters (4)](https://blog.canauri.com/topic/ransomware-decrypters) - [cybercrime (4)](https://blog.canauri.com/topic/cybercrime) - [managed service providers (4)](https://blog.canauri.com/topic/managed-service-providers) - [ransom (4)](https://blog.canauri.com/topic/ransom) - [ransomware ransom (4)](https://blog.canauri.com/topic/ransomware-ransom) - [Banking Trojans (3)](https://blog.canauri.com/topic/banking-trojans) - [Firewalls (3)](https://blog.canauri.com/topic/firewalls) - [Press Release (3)](https://blog.canauri.com/topic/press-release) - [Ransomware as a Service (3)](https://blog.canauri.com/topic/ransomware-as-a-service) - [WannaCry (3)](https://blog.canauri.com/topic/wannacry) - [Zero Day Vulnerability (3)](https://blog.canauri.com/topic/zero-day-vulnerability) - [business email compromise (3)](https://blog.canauri.com/topic/business-email-compromise) - [cyber security (3)](https://blog.canauri.com/topic/cyber-security) - [decryptors (3)](https://blog.canauri.com/topic/decryptors) - [ransomware attack (3)](https://blog.canauri.com/topic/ransomware-attack) - [BlueKeep (2)](https://blog.canauri.com/topic/bluekeep) - [CEO fraud (2)](https://blog.canauri.com/topic/ceo-fraud) - [COVID-19 (2)](https://blog.canauri.com/topic/covid-19) - [COVID-19 cybersecurity (2)](https://blog.canauri.com/topic/covid-19-cybersecurity) - [Cyberattack (2)](https://blog.canauri.com/topic/cyberattack) - [Fileless (2)](https://blog.canauri.com/topic/fileless) - [Fileless Malware (2)](https://blog.canauri.com/topic/fileless-malware) - [Fileless Ransomare (2)](https://blog.canauri.com/topic/fileless-ransomare) - [Fortnite vulnerability (2)](https://blog.canauri.com/topic/fortnite-vulnerability) - [MSPs (2)](https://blog.canauri.com/topic/msps) - [Patch (2)](https://blog.canauri.com/topic/patch) - [Small and Medium Enterprises Cybersecurity (2)](https://blog.canauri.com/topic/small-and-medium-enterprises-cybersecurity) - [Spear Phishing (2)](https://blog.canauri.com/topic/spear-phishing) - [WFH (2)](https://blog.canauri.com/topic/wfh) - [Wi-Fi Connections (2)](https://blog.canauri.com/topic/wi-fi-connections) - [Zero Day (2)](https://blog.canauri.com/topic/zero-day) - [Zero Day Attacks (2)](https://blog.canauri.com/topic/zero-day-attacks) - [bitcoin (2)](https://blog.canauri.com/topic/bitcoin) - [bitcoins (2)](https://blog.canauri.com/topic/bitcoins) - [cryptocurrency (2)](https://blog.canauri.com/topic/cryptocurrency) - [cryptocurrency mining (2)](https://blog.canauri.com/topic/cryptocurrency-mining) - [cryptojacking (2)](https://blog.canauri.com/topic/cryptojacking) - [cyber attacks on hospitals (2)](https://blog.canauri.com/topic/cyber-attacks-on-hospitals) - [cybersecurity jobs (2)](https://blog.canauri.com/topic/cybersecurity-jobs) - [defray (2)](https://blog.canauri.com/topic/defray) - [defray ransomware (2)](https://blog.canauri.com/topic/defray-ransomware) - [fortnite (2)](https://blog.canauri.com/topic/fortnite) - [gandcrab ransomware (2)](https://blog.canauri.com/topic/gandcrab-ransomware) - [hacking (2)](https://blog.canauri.com/topic/hacking) - [health (2)](https://blog.canauri.com/topic/health) - [healthcare (2)](https://blog.canauri.com/topic/healthcare) - [hospital cybersecurity (2)](https://blog.canauri.com/topic/hospital-cybersecurity) - [mac malware (2)](https://blog.canauri.com/topic/mac-malware) - [municipalities cyberattack (2)](https://blog.canauri.com/topic/municipalities-cyberattack) - [municipalities ransomware (2)](https://blog.canauri.com/topic/municipalities-ransomware) - [passwords (2)](https://blog.canauri.com/topic/passwords) - [ransomware attacks (2)](https://blog.canauri.com/topic/ransomware-attacks) - [ransomware normal (2)](https://blog.canauri.com/topic/ransomware-normal) - [scareware (2)](https://blog.canauri.com/topic/scareware) - [two-factor authentication (2)](https://blog.canauri.com/topic/two-factor-authentication) - [2018 cybersecurity (1)](https://blog.canauri.com/topic/2018-cybersecurity) - [2018 cybersecurity review (1)](https://blog.canauri.com/topic/2018-cybersecurity-review) - [2019 cybersecurity predictions (1)](https://blog.canauri.com/topic/2019-cybersecurity-predictions) - [2019 predictions (1)](https://blog.canauri.com/topic/2019-predictions) - [2020 Cybersecurity Predictions (1)](https://blog.canauri.com/topic/2020-cybersecurity-predictions) - [2FA (1)](https://blog.canauri.com/topic/2fa) - [Arizona (1)](https://blog.canauri.com/topic/arizona) - [Arizona beverages ransomware (1)](https://blog.canauri.com/topic/arizona-beverages-ransomware) - [BEC (1)](https://blog.canauri.com/topic/bec) - [BEC Attacks (1)](https://blog.canauri.com/topic/bec-attacks) - [BitPaymer (1)](https://blog.canauri.com/topic/bitpaymer) - [BlueKeep Exploit (1)](https://blog.canauri.com/topic/bluekeep-exploit) - [BlueKeep Vulnerability (1)](https://blog.canauri.com/topic/bluekeep-vulnerability) - [CISO (1)](https://blog.canauri.com/topic/ciso) - [Chief Information Security Officer (1)](https://blog.canauri.com/topic/chief-information-security-officer) - [Coronavirus (1)](https://blog.canauri.com/topic/coronavirus) - [Coronavirus scams (1)](https://blog.canauri.com/topic/coronavirus-scams) - [CryptoMix (1)](https://blog.canauri.com/topic/cryptomix) - [Cyber Liability Insurance (1)](https://blog.canauri.com/topic/cyber-liability-insurance) - [DLL (1)](https://blog.canauri.com/topic/dll) - [DLL CryptoMix (1)](https://blog.canauri.com/topic/dll-cryptomix) - [Data Leak (1)](https://blog.canauri.com/topic/data-leak) - [Deepfakes (1)](https://blog.canauri.com/topic/deepfakes) - [Dridex (1)](https://blog.canauri.com/topic/dridex) - [ERP (1)](https://blog.canauri.com/topic/erp) - [ERP Systems (1)](https://blog.canauri.com/topic/erp-systems) - [Enterprise Resource Planning (1)](https://blog.canauri.com/topic/enterprise-resource-planning) - [Exactis (1)](https://blog.canauri.com/topic/exactis) - [FIFA (1)](https://blog.canauri.com/topic/fifa) - [Fortnite ransomware (1)](https://blog.canauri.com/topic/fortnite-ransomware) - [GandCrab (1)](https://blog.canauri.com/topic/gandcrab) - [Google (1)](https://blog.canauri.com/topic/google) - [Have I been pwned (1)](https://blog.canauri.com/topic/have-i-been-pwned) - [Hospitals Ransomware (1)](https://blog.canauri.com/topic/hospitals-ransomware) - [Kirk (1)](https://blog.canauri.com/topic/kirk) - [Kirk Ransomware (1)](https://blog.canauri.com/topic/kirk-ransomware) - [LockBit (1)](https://blog.canauri.com/topic/lockbit) - [LockerGoga (1)](https://blog.canauri.com/topic/lockergoga) - [LockerGoga Ransomware (1)](https://blog.canauri.com/topic/lockergoga-ransomware) - [M&A (1)](https://blog.canauri.com/topic/ma) - [Malware (1)](https://blog.canauri.com/topic/malware) - [Marriott data breach (1)](https://blog.canauri.com/topic/marriott-data-breach) - [NASA (1)](https://blog.canauri.com/topic/nasa) - [NASA Data Breach (1)](https://blog.canauri.com/topic/nasa-data-breach) - [NCSAM (1)](https://blog.canauri.com/topic/ncsam) - [National Cyber Security Awareness Month (1)](https://blog.canauri.com/topic/national-cyber-security-awareness-month) - [Norsk (1)](https://blog.canauri.com/topic/norsk) - [Norsk Hydro (1)](https://blog.canauri.com/topic/norsk-hydro) - [PGA (1)](https://blog.canauri.com/topic/pga) - [Patch Tuesday (1)](https://blog.canauri.com/topic/patch-tuesday) - [Petya (1)](https://blog.canauri.com/topic/petya) - [Petya Ransomware (1)](https://blog.canauri.com/topic/petya-ransomware) - [Quora data breach (1)](https://blog.canauri.com/topic/quora-data-breach) - [RDP (1)](https://blog.canauri.com/topic/rdp) - [Remote Desktop Protocol (1)](https://blog.canauri.com/topic/remote-desktop-protocol) - [Remote workforce (1)](https://blog.canauri.com/topic/remote-workforce) - [RobbinHood Ransomware (1)](https://blog.canauri.com/topic/robbinhood-ransomware) - [Robbinhood (1)](https://blog.canauri.com/topic/robbinhood) - [SEC (1)](https://blog.canauri.com/topic/sec) - [SME (1)](https://blog.canauri.com/topic/sme) - [SME Cybersecurity (1)](https://blog.canauri.com/topic/sme-cybersecurity) - [SamSam (1)](https://blog.canauri.com/topic/samsam) - [SamSam Ransomware (1)](https://blog.canauri.com/topic/samsam-ransomware) - [Security Breach Notification Laws (1)](https://blog.canauri.com/topic/security-breach-notification-laws) - [Small and Medium Enterprises (1)](https://blog.canauri.com/topic/small-and-medium-enterprises) - [Sorebrect (1)](https://blog.canauri.com/topic/sorebrect) - [Star Trek (1)](https://blog.canauri.com/topic/star-trek) - [Syrk ransomware (1)](https://blog.canauri.com/topic/syrk-ransomware) - [Target (1)](https://blog.canauri.com/topic/target) - [Vidar (1)](https://blog.canauri.com/topic/vidar) - [Vidar infostealer (1)](https://blog.canauri.com/topic/vidar-infostealer) - [Vidar trojan (1)](https://blog.canauri.com/topic/vidar-trojan) - [WCry (1)](https://blog.canauri.com/topic/wcry) - [Wana Decryptor (1)](https://blog.canauri.com/topic/wana-decryptor) - [WanaCry (1)](https://blog.canauri.com/topic/wanacry) - [WanaDecryptor (1)](https://blog.canauri.com/topic/wanadecryptor) - [WannaCry 2.0 (1)](https://blog.canauri.com/topic/wannacry-2-0) - [World Cup (1)](https://blog.canauri.com/topic/world-cup) - [Yahoo (1)](https://blog.canauri.com/topic/yahoo) - [Yahoo Data Breach (1)](https://blog.canauri.com/topic/yahoo-data-breach) - [anatova (1)](https://blog.canauri.com/topic/anatova) - [anatova ransomware (1)](https://blog.canauri.com/topic/anatova-ransomware) - [arizona beverages (1)](https://blog.canauri.com/topic/arizona-beverages) - [atlanta (1)](https://blog.canauri.com/topic/atlanta) - [automobile (1)](https://blog.canauri.com/topic/automobile) - [automobile hacking (1)](https://blog.canauri.com/topic/automobile-hacking) - [azorult trojan (1)](https://blog.canauri.com/topic/azorult-trojan) - [banking trojan (1)](https://blog.canauri.com/topic/banking-trojan) - [bentley (1)](https://blog.canauri.com/topic/bentley) - [bitpaymer ransomware (1)](https://blog.canauri.com/topic/bitpaymer-ransomware) - [blackmail (1)](https://blog.canauri.com/topic/blackmail) - [budgeting (1)](https://blog.canauri.com/topic/budgeting) - [capital one (1)](https://blog.canauri.com/topic/capital-one) - [capital one data breach (1)](https://blog.canauri.com/topic/capital-one-data-breach) - [car hacking (1)](https://blog.canauri.com/topic/car-hacking) - [care (1)](https://blog.canauri.com/topic/care) - [chicago tribune (1)](https://blog.canauri.com/topic/chicago-tribune) - [collection (1)](https://blog.canauri.com/topic/collection) - [collection 1 (1)](https://blog.canauri.com/topic/collection-1) - [coronavirus cybersecurity (1)](https://blog.canauri.com/topic/coronavirus-cybersecurity) - [coronavirus phishing (1)](https://blog.canauri.com/topic/coronavirus-phishing) - [coronavirus ransomware (1)](https://blog.canauri.com/topic/coronavirus-ransomware) - [crypto (1)](https://blog.canauri.com/topic/crypto) - [crytocurrency hack (1)](https://blog.canauri.com/topic/crytocurrency-hack) - [currency (1)](https://blog.canauri.com/topic/currency) - [cyber insurance (1)](https://blog.canauri.com/topic/cyber-insurance) - [cybersecurity budgeting (1)](https://blog.canauri.com/topic/cybersecurity-budgeting) - [cybersecurity coronavirus (1)](https://blog.canauri.com/topic/cybersecurity-coronavirus) - [cybersecurity predictions (1)](https://blog.canauri.com/topic/cybersecurity-predictions) - [cybersecurity ventures (1)](https://blog.canauri.com/topic/cybersecurity-ventures) - [cybersecurity working remotely (1)](https://blog.canauri.com/topic/cybersecurity-working-remotely) - [dharma (1)](https://blog.canauri.com/topic/dharma) - [dharma ransomware (1)](https://blog.canauri.com/topic/dharma-ransomware) - [financial services (1)](https://blog.canauri.com/topic/financial-services) - [financial services data breach (1)](https://blog.canauri.com/topic/financial-services-data-breach) - [government cyberattack (1)](https://blog.canauri.com/topic/government-cyberattack) - [holiday shopping (1)](https://blog.canauri.com/topic/holiday-shopping) - [hospitals hit with ransomware (1)](https://blog.canauri.com/topic/hospitals-hit-with-ransomware) - [iEncrypt (1)](https://blog.canauri.com/topic/iencrypt) - [insider trading (1)](https://blog.canauri.com/topic/insider-trading) - [insurance (1)](https://blog.canauri.com/topic/insurance) - [laundering (1)](https://blog.canauri.com/topic/laundering) - [leak (1)](https://blog.canauri.com/topic/leak) - [los angeles times (1)](https://blog.canauri.com/topic/los-angeles-times) - [man in the disk (1)](https://blog.canauri.com/topic/man-in-the-disk) - [man in the disk attacks (1)](https://blog.canauri.com/topic/man-in-the-disk-attacks) - [maritime cybersecurity (1)](https://blog.canauri.com/topic/maritime-cybersecurity) - [maze ransomware (1)](https://blog.canauri.com/topic/maze-ransomware) - [pensacola florida (1)](https://blog.canauri.com/topic/pensacola-florida) - [phobos (1)](https://blog.canauri.com/topic/phobos) - [phobos ransomware (1)](https://blog.canauri.com/topic/phobos-ransomware) - [quarter 1 2019 ransomware (1)](https://blog.canauri.com/topic/quarter-1-2019-ransomware) - [raccoon stealer (1)](https://blog.canauri.com/topic/raccoon-stealer) - [ransomware data breaches (1)](https://blog.canauri.com/topic/ransomware-data-breaches) - [ransomware defined (1)](https://blog.canauri.com/topic/ransomware-defined) - [ransomware epidemic (1)](https://blog.canauri.com/topic/ransomware-epidemic) - [ransomware hits municipalities (1)](https://blog.canauri.com/topic/ransomware-hits-municipalities) - [ransomware statistics (1)](https://blog.canauri.com/topic/ransomware-statistics) - [riviera beach ransomware attack (1)](https://blog.canauri.com/topic/riviera-beach-ransomware-attack) - [ryuk (1)](https://blog.canauri.com/topic/ryuk) - [ryuk ransomware (1)](https://blog.canauri.com/topic/ryuk-ransomware) - [scammers (1)](https://blog.canauri.com/topic/scammers) - [scams targeting holiday shoppers (1)](https://blog.canauri.com/topic/scams-targeting-holiday-shoppers) - [securities and exchange commission (1)](https://blog.canauri.com/topic/securities-and-exchange-commission) - [sextortion (1)](https://blog.canauri.com/topic/sextortion) - [shipping industry (1)](https://blog.canauri.com/topic/shipping-industry) - [snake ransomware (1)](https://blog.canauri.com/topic/snake-ransomware) - [social engineering (1)](https://blog.canauri.com/topic/social-engineering) - [southwire (1)](https://blog.canauri.com/topic/southwire) - [stop paying the ransom (1)](https://blog.canauri.com/topic/stop-paying-the-ransom) - [tips for working remotely (1)](https://blog.canauri.com/topic/tips-for-working-remotely) - [tribune (1)](https://blog.canauri.com/topic/tribune) - [ursnif (1)](https://blog.canauri.com/topic/ursnif) - [wall street journal (1)](https://blog.canauri.com/topic/wall-street-journal) - [what is ransomware (1)](https://blog.canauri.com/topic/what-is-ransomware) - [working from home (1)](https://blog.canauri.com/topic/working-from-home) - [working remotely (1)](https://blog.canauri.com/topic/working-remotely) see all ##### Contact [415 12th Ave SE, Suite 201 Cedar Rapids, IA 52401](https://www.google.com/maps/place/415+12th+Ave+SE+%23201,+Cedar+Rapids,+IA+52401/@41.9710436,-91.6582952,17z/data=!3m1!4b1!4m5!3m4!1s0x87e4f73f67891f6d:0x38f71e45a9fa7c1f!8m2!3d41.9710436!4d-91.6561065) [319-383-0165](tel:319-383-0165) [support@getcryptostopper.com](mailto:support@getcryptostopper.com) Facebook Twitter Linkedin YouTube - Products - [CryptoStopper™](https://www.getcryptostopper.com/cryptostopper/) - [Endpoint Security](https://www.getcryptostopper.com/tools/endpoint-security/) - Free Tools - [Ransomware Simulator](https://www.getcryptostopper.com/ransomware-simulator/) - [Network Tools](https://www.getcryptostopper.com/free-network-tools/) - [Ransomware Decryptors](https://www.getcryptostopper.com/ransomware-decryptors/) - Company - [About](https://www.getcryptostopper.com/about/) - [Careers](https://www.getcryptostopper.com/careers/) - [Contact](https://www.getcryptostopper.com/contact/) © Copyright WatchPoint Data, All Rights Reserved   |   [Terms](https://www.getcryptostopper.com/terms)