Loading story…
GandCrab grew into one of the most prominent ransomware-as-a-service (RaaS) operations by pairing frequent malware updates with a broad affiliate program, exploit-kit distribution, and supporting criminal services such as crypters. Technical analyses found the malware used anti-analysis and anti-recovery features, selective language checks to avoid CIS targets, privilege-escalation exploits in later 5.x builds, and even a downloader that attempted persistence, Windows Defender and firewall bypasses, removable-drive propagation, and delivery of fresh payloads from hard-coded URLs. Researchers also documented repeated coding mistakes that enabled multiple public vaccines and decryptors, while defenders and projects such as No More Ransom helped victims recover files without paying in some cases.
The operation also fought an extended defensive battle with South Korean vendor AhnLab, repeatedly changing tactics to evade or disable V3 Lite, including uninstall automation, service termination, and code injection into Autoup.exe, while AhnLab and other vendors countered with kill switches, patches, and blocking methods. GandCrab’s operators announced they were shutting down after claiming enormous profits, but reporting and later law-enforcement action indicated the ecosystem did not simply disappear: a Belarusian affiliate was arrested for allegedly infecting more than 1,000 systems across nearly 100 countries, and researchers noted likely continuity between GandCrab personnel or code and later ransomware activity including REvil/Sodinokibi.
TTPs, infrastructure, and targeting history in one profile.
20 events from the most recent confirmed update back to the earliest known activity.
GandCrab ceased operations in mid-2019, with reporting indicating the shutdown took effect around the start of June and no new variants were observed afterward.
GandCrab's operators publicly announced they were shutting down the ransomware-as-a-service operation after claiming massive profits from the scheme.
Europol stated that more than 14,000 victims had recovered files using the newer GandCrab decryptor.
A decryptor released at the end of January 2019 led GandCrab's operators to respond with version 5.2, which changed encrypted file naming to random extensions.
GandCrab v5.0.4, observed in January 2019, moved away from uninstalling V3 Lite and instead attempted to stop the V3 service using dropped helper files and ASDCli.exe.
AhnLab added a CAPTCHA to the V3 Lite uninstall program to stop GandCrab from automating product removal.
A decryptor for GandCrab versions up to 5.03 was released through the No More Ransom platform, enabling victims to recover files without paying.
In September 2018, GandCrab updated its code to hide the V3 Lite uninstallation screen and automate button clicks without the user's knowledge.
In August 2018, the GandCrab creator told Bleeping Computer that an upcoming version would include a zero-day targeting AhnLab V3 Lite and shared exploit code.
GandCrab v4.1.2 was identified on July 17, 2018 after changing the .lock filename generation algorithm used in prior blocking methods and including a taunting message referencing Fortinet and AhnLab. AhnLab analyzed the modified routine and released an updated blocking tool that could still prevent encryption if the correct .lock file was created in the Common AppData path.
AhnLab released a public executable tool to block GandCrab after reverse engineering updated variants and their encryption logic.
Fortinet published a blocking method based on the presence of a .lock file in the Common AppData directory, and AhnLab confirmed it also worked against GandCrab v4.1.1.
By July 2018, GandCrab was being distributed through drive-by downloads, email, executable files, and fileless malware.
AhnLab released a public kill switch intended to prevent GandCrab from encrypting files on infected systems.
Version 2 of GandCrab appeared and fixed earlier implementation mistakes that had enabled prior free decryptors.
AhnLab reported active GandCrab distribution in South Korea, marking an early documented stage in the conflict between GandCrab and the vendor's V3 Lite product.
GandCrab first appeared in late January 2018 and went on to become a major ransomware-as-a-service threat through 2018 and the first half of 2019.
Belarusian authorities announced the arrest of a 31-year-old Gomel resident accused of acting as a GandCrab affiliate, infecting more than 1,000 computers across nearly 100 countries. Romanian and UK law enforcement assisted in identifying the suspect.
A newly released GandCrab-associated downloader was observed with anti-analysis features, removable-drive propagation, archive infection attempts, and hard-coded URLs used to fetch a new ransomware payload.
AhnLab released an emergency patch after GandCrab attack code targeting V3 Lite was revealed and shown capable of triggering a BSOD after encryption.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 16 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
10 references tracked. Mallory keeps watching after this page renders.
nomoreransom.org
Open sourcebleepingcomputer.com
Open sourcevirusbulletin.com
Open sourcevirusbulletin.com
Open sourcezdnet.com
Open sourcetccontre.blogspot.com
Open sourcebleepingcomputer.com
Open sourceasec.ahnlab.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Law enforcement and industry partners released a free **No More Ransom** decryption tool for victims of **GandCrab** ransomware, offering recovery support for most known variants of one of 2018’s most widespread ransomware families. Europol said the tool was developed with the Romanian Police, international law enforcement partners, and Bitdefender, and came after GandCrab had infected nearly half a million victims worldwide while demanding payments ranging from **$300 to $6,000** in **Bitcoin** or **DASH**. The release marked a significant disruption of a ransomware-as-a-service operation that had scaled rapidly through affiliate partnerships across the cybercrime ecosystem. GandCrab had spread through multiple delivery channels, including malspam campaigns disguised as receipts or order notices and payloads hosted on compromised legitimate websites. Reporting from Cisco Talos and BleepingComputer described infection chains using ZIP archives, macro-enabled Word documents, VBScript, fake CAPTCHA pages, and PowerShell-based downloaders, with some campaigns also abusing compromised sites and `certutil.exe` to retrieve payloads. Once executed, GandCrab encrypted files, appended the `.CRAB` extension, altered desktop wallpapers, and communicated through infrastructure including Tor and **Namecoin `.bit` domains**, underscoring both the scale of the threat and the practical value of the newly released decryptor.
Aug 15, 2026
REvil, also known as Sodinokibi and tracked by some researchers as **GOLD SOUTHFIELD**, evolved into one of the most consequential ransomware-as-a-service operations by combining aggressive affiliate-driven intrusions with increasingly sophisticated extortion. Reporting tied the group to multiple access methods including RDP brute force, spam, watering-hole compromises, malvertising, unpatched VPN and RDP systems, and malware such as **IcedID** and **Qakbot**. Researchers also documented how REvil’s malware and ecosystem were reused or repurposed: Secureworks assessed that **LV ransomware** was a modified REvil 2.03 beta with a replaced configuration, while separate reporting linked REvil’s rise to the vacuum left by **GandCrab** and described its shift toward leak-site pressure, targeted credential fields, affiliate tracking, and removal of geographic execution restrictions in later samples. The operation’s most damaging campaign exploited multiple zero-day vulnerabilities in **Kaseya VSA**, abusing the platform’s auto-update mechanism to push ransomware through managed service providers and impact an estimated **1,500 downstream organizations**. Victims included Swedish retailers and dozens of customers served by affected MSPs, prompting Kaseya to shut down SaaS VSA, advise customers to take internet-exposed on-premises servers offline, and work with the FBI. After law-enforcement disruption and arrests, researchers reported revived REvil Tor infrastructure and newly compiled samples in 2022 that appeared to come from source code rather than recycled binaries, with updated keys, payment domains, victim-specific account targeting, and evidence of active development despite one buggy build that renamed files without encrypting them.
Aug 15, 2026
Avaddon emerged as a **ransomware-as-a-service** operation that initially spread through a massive phishing campaign using smiley-themed lures such as “Your new photo?” and JavaScript attachments disguised as images. The malware downloaded its payload with PowerShell and `BITSAdmin`, encrypted files with the `.avdn` extension, dropped HTML ransom notes, changed desktop wallpaper, and directed victims to Tor-based payment pages. Researchers and vendors linked early distribution to large botnet-driven spam activity and later observed affiliates using additional access methods including exposed **RDP**, weak **VPN** credentials, and network vulnerability exploitation. As the operation matured, Avaddon expanded into multi-extortion, publicly listing victims on a leak site, releasing stolen data, and in some cases adding **DDoS** pressure while continuously updating its code to evade detection and defeat public decryptors. Reports described anti-analysis features, persistence via scheduled tasks and Run registry keys, deletion of backups and shadow copies, and regional exclusions that avoided CIS-language systems. After becoming one of the most active ransomware threats and drawing warnings from authorities, the group abruptly shut down and released **2,934 decryption keys**, which were validated by incident-response firms and used to build a free decryptor for victims.
Aug 15, 2026