CryptoJoker is a family of Windows ransomware dating from January 2016, with a new build turning up roughly once a year after that. The original build appended .crjoker and left a note called README!!!.txt, alongside an HTML lock screen. Its installer posed as a PDF, which points to email delivery. Newer builds changed the suffix: the 2020 build used .nocry with the note CryptoJoker Recovery Information.txt, and a 2021 build appends the operator email and .b00m, writing HACKED.txt. Targets are ordinary Windows user files on a single machine. No build has shown a data theft step or a leak site. Later versions descend partly from the open-source EDA2 code, and the family shares lineage with the Executioner and CryptoNar strains.
File extensions: .b00m
Decryptor: No public decryptor was found. Checked 2026-10-13.
The ransomware identification tool didn’t load. This is usually temporary — please refresh. If you’re dealing with an active incident, don’t wait on it:
Emergency response: +1 (877) 364-5161