GPcode: The Ransomware That Turned Extortion Into a Math Problem

How a quiet 2004 email scam became the encryption template every ransomware strain still follows.

Part of Adaptive Security’s series on the ransomware attacks that shaped modern cyber defense. Read the full hub story: A History of Notable Ransomware Attacks.

In December 2004, researchers at Kaspersky Lab opened a batch of encrypted files with no idea how to unlock them. There was no slick ransom screen. There was no cryptocurrency wallet. There was a text file pointing to a payment account with Yandex, the Russian equivalent of PayPal at the time. It was one of the first times anyone had seen a piece of software lock up a victim's own files and charge money to give them back. The program came to be known as GPcode. It was the first ransomware to prove a simple point: the extortion only works if the encryption is strong enough to survive an attack. Weak encryption meant a free fix and a worthless ransom note.

GPcode started with an email. The people behind it pulled contact lists from job.ru, a Russian recruitment site, and sent messages made to look like they came from Western employers. Attached was a file named anketa.doc, Russian for application form. Anyone who opened it and enabled the macros inside triggered the infection without seeing anything unusual happen on screen. Victims found out something was wrong only when their documents stopped opening.

A text file named readme.txt gave the instructions.

Email an address at mail.ru. Send payment to a Yandex account.

In December 2004, the price was 1,000 rubles, about thirty-five dollars. Within two years, the demand had grown to 2,000 rubles, around seventy dollars. The amount was small by design. A modest demand was easy for most victims to pay quietly, and awkward to explain to the police.

An Encryption Arms Race

The first version of GPcode used a homemade encryption method, and Kaspersky’s researchers broke it within days. They broke the next version too, in June 2005. In January 2006, a new variant switched to RSA, the public key cryptography that still secures online banking and email today. Kaspersky broke that version as well. Then the key length started climbing. Fifty-six bits that spring. Sixty-seven bits weeks later. By June of that year, three new versions arrived within days of each other, jumping to 260 bits, then 330, then 660. Every increase sent Kaspersky’s team back to the drawing board. For nearly two years, it looked like a race the researchers could always win.Researchers saw this coming more than ten years before it happened. In 1996, Adam Young and Moti Yung wrote a paper about an idea they called cryptoviral extortion. The idea was simple: a piece of malware could lock a victim’s files using the attacker’s public key, so only the attacker’s matching private key could unlock them. Yung, a cryptographer at Columbia University, later pointed out how closely that idea matched what showed up years afterward. “Around 2007, strong ransomware employing public-key cryptography started to appear,” he said. GPcode proved the idea worked well beyond an academic paper.

The Version Nobody Could Crack

The escalation reached its peak in June 2008, with a version called GPcode.ak. It layered two forms of protection: RC4 encryption on the files themselves, and a 1024-bit RSA key protecting the RC4 key. That length matters. Kaspersky Lab estimated it would take around 15 million computers running for a year to crack a key that size through brute force. For the first time, the company that had cracked every earlier version could not crack this one.

Kaspersky made an unusual move. Instead of working alone, it published the encrypted files and issued a public call to the wider research community. “We're calling on you: cryptographers, governmental and scientific institutions, antivirus companies, independent researchers, join with us to stop Gpcode,” Kaspersky’s appeal read. Eran Tromer, a cryptographer at MIT’s Computer Science and Artificial Intelligence Laboratory, hosted the public effort to verify and attack the released keys. The math held. GPcode.ak was never broken through cryptanalysis.Still, not every victim lost their files. When GPcode.ak locked a file, it created an encrypted copy elsewhere on the disk and then deleted the original, instead of wiping it for good. That left traces behind, so ordinary file recovery tools could often pull the original back, no matter how strong the encryption on the locked copy was. Kaspersky used that gap to publish free instructions for getting files back. It’s a reminder that strong encryption only helps an attacker who is just as careful with every other part of the job.

The Template Everything Else Followed

GPcode was never tied to a criminal group researchers could name. No press conference, no branded logo, no leader ever identified. What it left behind was a template. Every ransomware strain that followed, from CryptoLocker to Cryptorbit to WannaCry to GandCrab, built on the idea GPcode proved first: encrypt with a key only the attacker holds, so the victim's path back to their files runs through payment, since breaking that kind of encryption without the attacker's key is nearly impossible.

Understanding that template is the first step toward defending against everything that came after it. Adaptive Security studies this history to build training and defenses shaped by how these attacks began in the first place.

Next in this series: Cryptorbit, the wave of copycats that turned ransomware into a repeatable business.