Free No More Ransom Decryptor Released for GandCrab Victims

Law enforcement and industry partners released a free No More Ransom decryption tool for victims of GandCrab ransomware, offering recovery support for most known variants of one of 2018’s most widespread ransomware families. Europol said the tool was developed with the Romanian Police, international law enforcement partners, and Bitdefender, and came after GandCrab had infected nearly half a million victims worldwide while demanding payments ranging from $300 to $6,000 in Bitcoin or DASH. The release marked a significant disruption of a ransomware-as-a-service operation that had scaled rapidly through affiliate partnerships across the cybercrime ecosystem.

GandCrab had spread through multiple delivery channels, including malspam campaigns disguised as receipts or order notices and payloads hosted on compromised legitimate websites. Reporting from Cisco Talos and BleepingComputer described infection chains using ZIP archives, macro-enabled Word documents, VBScript, fake CAPTCHA pages, and PowerShell-based downloaders, with some campaigns also abusing compromised sites and certutil.exe to retrieve payloads. Once executed, GandCrab encrypted files, appended the .CRAB extension, altered desktop wallpapers, and communicated through infrastructure including Tor and Namecoin .bit domains, underscoring both the scale of the threat and the practical value of the newly released decryptor.