CryptoShield is an updated version of CryptoMix ransomware. CryptoShield is distributed with the help of Exploit Kits. Once infiltrated, this ransomware encrypts various data using RSA-2048 cryptography and adds the extension ".CRYPTOSHIELD.", ".CRYPTOSHIELD" or ".CRYPTOSHIEL" to each file name. After a successful encryption, CryptoShield creates two files ("# RESTORING FILES #.HTML" and "# RESTORING FILES #.TXT"), placing them in each folder containing encrypted files.