CurveLock: Exploring Elliptic Curves Implementation in Modern Ransomware

CurveLock: Exploring Elliptic Curves Implementation in Modern Ransomware | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Research Article CurveLock: Exploring Elliptic Curves Implementation in Modern Ransomware Swayam Tejas Padhy, Shanthi P B, Harish S V, Smitha N Pai This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-6072623/v1 This work is licensed under a CC BY 4.0 License Status: Posted Version 1 posted You are reading this latest preprint version Abstract The rapid evolution of ransomware poses a significant threat to society, with attackers continuously developing advanced evasion techniques and encryption methods to bypass detection and maximize impact. This study examines the future of ransomware encryption and the increasing ubiquity of Ransomware-as-a-Service (RaaS), which allows even non-technical individuals to execute elaborate attacks. We present CurveLock, a proof-of-concept malware intended to showcase the advanced capabilities of next generation ransomware. CurveLock utilizes elliptic curve cryptography(ECC) in conjunction with the Diffie-Hellman key exchange to generate AES-256 encryption keys, hence securing strong and efficient file encryption. This method not only improves cryptographic resilience but also reduces computational burden, making it more scalable for extensive largescale attacks. Additionally, CurveLock incorporates multiple evasive measures, such as NT Layer DLL (NTDLL) unhooking, Application Programming Interface (API) hammering, and compile-time Import Address Table (IAT) camouflage,to evade detection by modern security solutions. By analyzing CurveLock’s architecture and techniques, this paper highlights the increasing sophistication of ransomware and underscores the urgent need for advanced defensive strategies. Ransomware Elliptic Curves Cryptography (ECC) NTDLL unhooking Ransomware as a service (RaaS) File encryption API Hammering Full Text Additional Declarations No competing interests reported. Cite Share Download PDF Status: Posted Version 1 posted You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {"props":{"pageProps":{"initialData":{"identity":"rs-6072623","acceptedTermsAndConditions":true,"allowDirectSubmit":true,"archivedVersions":[],"articleType":"Research Article","associatedPublications":[],"authors":[{"id":422135694,"identity":"4aad54da-0c43-4617-8ee4-7e52b59606f9","order_by":0,"name":"Swayam Tejas Padhy","email":"","orcid":"","institution":"Manipal Academy of Higher Education","correspondingAuthor":false,"prefix":"","firstName":"Swayam","middleName":"Tejas","lastName":"Padhy","suffix":""},{"id":422135695,"identity":"7b1f6eca-2d7d-4d0f-a504-8711ddaacb5a","order_by":1,"name":"Shanthi P B","email":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAABI0lEQVRIiWNgGAWjYDACCSBmbJAAsxkbGBgS+EGsBAYGGSBlgFPLQYQWgwTJBogWHgJaGBBaDA5AODi1yM9ufvb44w4LBt325mMfZ1T8yTO+dvjZg4c77HgY2Ju3SWDRYnDnmLnBwTMSDGZnjiXP3HDGoNjsdpq5QeKZZB4GnmNlWLVIJJhJHGwDarmRY8z4sM0gcdttoEhiGzMPg0SOGTYt8jPSv6Fq2TwbKJLYVs/DIP8GqxaGGzlItmwEatkgnQOy5TDQFh6sWgxu5JRJnG0DygL9wjjjjHHijNtAkcQzx3nYeNKKLbA7bJtEZVudnNnx5sOMPRVyif2z07dJ/txRLcfPfnjjDWwOgwIeVC4oHbDhUY4FgLSMglEwCkbBKIACABffZcL2N5NaAAAAAElFTkSuQmCC","orcid":"","institution":"Manipal Academy of Higher Education","correspondingAuthor":true,"prefix":"","firstName":"Shanthi","middleName":"P","lastName":"B","suffix":""},{"id":422135696,"identity":"8c9000bc-94be-4e4b-8a63-a8986ac7ae13","order_by":2,"name":"Harish S V","email":"","orcid":"","institution":"Manipal Academy of Higher Education","correspondingAuthor":false,"prefix":"","firstName":"Harish","middleName":"S","lastName":"V","suffix":""},{"id":422135697,"identity":"ac322537-ec20-41bd-88df-57a5d90774fc","order_by":3,"name":"Smitha N Pai","email":"","orcid":"","institution":"Manipal Academy of Higher Education","correspondingAuthor":false,"prefix":"","firstName":"Smitha","middleName":"N","lastName":"Pai","suffix":""}],"badges":[],"createdAt":"2025-02-20 14:08:13","currentVersionCode":1,"declarations":"","doi":"10.21203/rs.3.rs-6072623/v1","doiUrl":"https://doi.org/10.21203/rs.3.rs-6072623/v1","draftVersion":[],"editorialEvents":[],"editorialNote":"","failedWorkflow":false,"files":[{"id":94474824,"identity":"f0f288e8-5ee9-4134-80f6-79524a9f31e3","added_by":"auto","created_at":"2025-10-27 15:50:14","extension":"pdf","order_by":1,"title":"","display":"","copyAsset":false,"role":"manuscript-pdf","size":1450049,"visible":true,"origin":"","legend":"","description":"","filename":"CurveLockExploringEllipticCurvesImplementationinModernRansomware.pdf","url":"https://assets-eu.researchsquare.com/files/rs-6072623/v1_covered_59cd855d-0556-47a7-a1d2-fd4c6406fb7e.pdf"}],"financialInterests":"No competing interests reported.","formattedTitle":"CurveLock: Exploring Elliptic Curves Implementation in Modern Ransomware","fulltext":[],"fulltextSource":"","fullText":"","funders":[],"hasAdminPriorityOnWorkflow":false,"hasManuscriptDocX":false,"hasOptedInToPreprint":true,"hasPassedJournalQc":"","hasAnyPriority":false,"hideJournal":true,"highlight":"","institution":"","isAcceptedByJournal":false,"isAuthorSuppliedPdf":true,"isDeskRejected":"","isHiddenFromSearch":false,"isInQc":false,"isInWorkflow":false,"isPdf":true,"isPdfUpToDate":true,"isWithdrawnOrRetracted":false,"journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true},"keywords":"Ransomware, Elliptic Curves Cryptography (ECC), NTDLL unhooking, Ransomware as a service (RaaS), File encryption, API Hammering","lastPublishedDoi":"10.21203/rs.3.rs-6072623/v1","lastPublishedDoiUrl":"https://doi.org/10.21203/rs.3.rs-6072623/v1","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"manuscriptAbstract":"The rapid evolution of ransomware poses a significant threat to society, with attackers continuously developing advanced evasion techniques and encryption methods to bypass detection and maximize impact. This study examines the future of ransomware encryption and the increasing ubiquity of Ransomware-as-a-Service (RaaS), which allows even non-technical individuals to execute elaborate attacks. We present CurveLock, a proof-of-concept malware intended to showcase the advanced capabilities of next generation ransomware. CurveLock utilizes elliptic curve cryptography(ECC) in conjunction with the Diffie-Hellman key exchange to generate AES-256 encryption keys, hence securing strong and efficient file encryption. This method not only improves cryptographic resilience but also reduces computational burden, making it more scalable for extensive largescale attacks. Additionally, CurveLock incorporates multiple evasive measures, such as NT Layer DLL (NTDLL) unhooking, Application Programming Interface (API) hammering, and compile-time Import Address Table (IAT) camouflage,to evade detection by modern security solutions. By analyzing CurveLock’s architecture and techniques, this paper highlights the increasing sophistication of ransomware and underscores the urgent need for advanced defensive strategies.","manuscriptTitle":"CurveLock: Exploring Elliptic Curves Implementation in Modern Ransomware","msid":"","msnumber":"","nonDraftVersions":[{"code":1,"date":"2025-03-03 06:10:59","doi":"10.21203/rs.3.rs-6072623/v1","editorialEvents":[{"type":"communityComments","content":1}],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true}}],"origin":"","ownerIdentity":"bd203997-b102-44c0-8d20-418aa0d35f4c","owner":[],"postedDate":"March 3rd, 2025","published":true,"recentEditorialEvents":[],"rejectedJournal":[],"revision":"","amendment":"","status":"posted","subjectAreas":[],"tags":[],"updatedAt":"2025-10-27T14:38:05+00:00","versionOfRecord":[],"versionCreatedAt":"2025-03-03 06:10:59","video":"","vorDoi":"","vorDoiUrl":"","workflowStages":[]},"version":"v1","identity":"rs-6072623","journalConfig":"researchsquare"},"__N_SSP":true},"page":"/article/[identity]/[[...version]]","query":{"redirect":"/article/rs-6072623","identity":"rs-6072623","version":["v1"]},"buildId":"8U1c8b4HqxoKbykW_rLl7","isFallback":false,"isExperimentalCompile":false,"dynamicIds":[84888],"gssp":true,"scriptLoader":[]}