GandCrab RaaS Combined Rapid Evasion, Affiliate Scale, and Post-Shutdown Fallout

GandCrab grew into one of the most prominent ransomware-as-a-service (RaaS) operations by pairing frequent malware updates with a broad affiliate program, exploit-kit distribution, and supporting criminal services such as crypters. Technical analyses found the malware used anti-analysis and anti-recovery features, selective language checks to avoid CIS targets, privilege-escalation exploits in later 5.x builds, and even a downloader that attempted persistence, Windows Defender and firewall bypasses, removable-drive propagation, and delivery of fresh payloads from hard-coded URLs. Researchers also documented repeated coding mistakes that enabled multiple public vaccines and decryptors, while defenders and projects such as No More Ransom helped victims recover files without paying in some cases.

The operation also fought an extended defensive battle with South Korean vendor AhnLab, repeatedly changing tactics to evade or disable V3 Lite, including uninstall automation, service termination, and code injection into Autoup.exe, while AhnLab and other vendors countered with kill switches, patches, and blocking methods. GandCrab’s operators announced they were shutting down after claiming enormous profits, but reporting and later law-enforcement action indicated the ecosystem did not simply disappear: a Belarusian affiliate was arrested for allegedly infecting more than 1,000 systems across nearly 100 countries, and researchers noted likely continuity between GandCrab personnel or code and later ransomware activity including REvil/Sodinokibi.