Cr1ptT0r Ransomware is new type of ransomware, that uses network disk array vulnerability to infect user’s computers. This crypto ransomware encrypts data on network (cloud, NAS, Network Attached Storage) storage using a special encryption algorithm, and then requires a ransom of ~ 0.3 BTC to return files. Original title Cr1ptT0r is indicated in the ransom note and on the page on the OpenBazaar website. Developers call themselves a Cr1ptT0r team. The ELF ARM binary is used for Linux systems with a focus on embedded devices, but depending on the manufacturer it can be adapted for Windows. Virus creates 2 files: _FILES_ENCRYPTED_README.txt and _cr1ptt0r_support.txt. The Sodium crypto library and the asymmetric encryption algorithm “curve25519xsalsa20poly1305” (Curve25519, Salsa20, Poly1305) are used for encryption. The open 256-bit encryption key is located in the cr1ptt0r_logs.txt file, which also stores the list of encrypted files, and it is also added to the end of the encrypted files, just before the marker. Cr1ptT0r Ransomware uses the OpenBazaar site to “support” the affected and selling the decoder. There are no decryption tool available yet, however, using instructions in this article can help you recover encrypted files. Follow the guide below to remove Cr1ptT0r Ransomware and decrypt your files in Windows 10, 8/8.1, Windows 7.