The system is not detecting that a payment has been made.
Paying a ransom should be the last and desperate option of infected users to get their data back. It is understandable that sometimes people or corporations don’t really have another choice. However, even paying the ransom would not guarantee you would get the decryption key. Therefore, many security experts advise people that this is generally a bad idea. The recent case with the .cryp1 encryption proves this point.
Victims of the notorious CryptXXX, also known under its re branded name UltraCrypter, have reported that they have not received a Decryption key for the .cryp1 encryption even after they had made the payment. The latest version of this ransomware appears to have some significant issues with its payment system. According to the victims that have burned out their money for a ransom, the UltraDeCrypter payment system does not recognize the payments and does not allow them to download the decryption key.
On the top of that, since the system is not detecting that a payment has been made, the initial ransom amount of 1.2 bitcoin doubles to 2.4 bitcoin when the timer runs down. It seems that the hackers have put a lot of efforts into updating the ransomware, but they missed out the payment platform issues. This is not the first time such issues appeared. In previous versions, users were given Decryption keys that were not working and it took quite a while until the hackers fixed them. That resulted in many victims losing their money for nothing by trying to pay the ransom.
In case you really have no other option to recover your data and you are planning to make a payment to these crooks, now is really not the time. Keep on hold with your money. We strongly advise you not to pay the ransom at least until these flaws with the payment system are fixed. Meanwhile, it is worth to check some of the steps in the removal guide here, or wait for a decryptor solution to be released. There is a real chance that the ransom payment now may really trick you by only taking your money and give you nothing in return.
Shortly after the reported cases of malfunction, a Help Desk System appeared on the payment website. This is probably because the crooks behind CryptXXX/UltraCrypter are still struggling with the payment site and keep having problems with the system. This Help Desk contains a form, that victims can fill in to contact the payment server operators if they face a problem. To the victims who already paid, there are no other options left but to hope these issues will be fixed and leave their data on the hackers mercy. To the ones who have not, this comes as a warning that proves how unfair and risky is to get into a bargain with cybercriminals.