Loading malware…
GandCrab was a highly active Windows ransomware family and one of the defining ransomware-as-a-service operations of 2018 and 2019. It was distributed through an affiliate model in which core operators supplied the malware and payment infrastructure while partners handled victim acquisition and deployment. Reported delivery methods included spam campaigns, exploit kits, and targeted intrusions against organizations, including attacks involving exposed services and compromised managed service environments. GandCrab was also delivered by other malware ecosystems and botnets, and it was used by multiple criminal affiliates rather than a single intrusion set.
On execution, GandCrab encrypted victim files and presented ransom instructions, with later variants evolving rapidly through frequent version updates. The family became notable for aggressive operator behavior, public taunting of defenders, and fast adaptation to defensive countermeasures. Some versions incorporated code intended to disrupt security software, including a retaliatory denial-of-service routine aimed at an AhnLab antivirus product. GandCrab’s operators also ran a mature revenue-sharing program and were widely cited as helping popularize the modern large-scale RaaS model later associated with successor operations.
The malware’s development history included multiple implementation flaws and infrastructure compromises that enabled the release of several public decryptors. Security vendors and law-enforcement partners repeatedly recovered or leveraged key material to support victim recovery for various versions. GandCrab was eventually announced as retired by its operators in 2019, after which REvil/Sodinokibi was widely assessed as a successor operation or continuation by overlapping actors and affiliates.
GandCrab primarily targeted Windows systems and affected a broad international victim base across consumer and enterprise environments. It was among the most prominent ransomware threats of its period due to its scale, affiliate ecosystem, rapid iteration, and influence on subsequent ransomware operations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
6 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
In April 2018, Magnitude unexpectedly started pushing the ever-growing GandCrab ransomware, shortly after having adopted a fresh Flash zero-day (CVE-2018-4878).
CVE-2016-7255 Classification: 0-Day Basic Description: Memory corruption in NtUserSetWindowLongPtr ... Found in the following Malware samples: Attributed to APT28 (aka Fancy Bear, Sednit). Used later by Ursnif, Dreambot, GandCrab, Cerber, Maze | Used later by Ursnif, Dreambot, GandCrab, Cerber, Maze
Atlassian Confluence Server and Data Center Widget Connector is vulnerable to a server-side template injection attack... Multiple malware campaigns have taken advantage of this vulnerability; the most notable being GandCrab ransomware. | Multiple malware campaigns have taken advantage of this vulnerability; the most notable being GandCrab ransomware.
One important change in the 5.x version was the inclusion of exploits to elevate privileges. The exploits were CVE-2018-8440 by SandboxEscaper, and CVE-2018-8120. Both exploits were used in Windows 7 and newer OS versions to try to get SYSTEM privileges. With CVE-2018-8120, it tried to steal the system token of the SYSTEM idle process. | This paper examines the GandCrab ransomware, the biggest Ransomware-as-a-Service (RaaS) threat seen in 2018 and the first half of 2019.
One important change in the 5.x version was the inclusion of exploits to elevate privileges. The exploits were CVE-2018-8440 by SandboxEscaper, and CVE-2018-8120. Both exploits were used in Windows 7 and newer OS versions to try to get SYSTEM privileges. | This paper examines the GandCrab ransomware, the biggest Ransomware-as-a-Service (RaaS) threat seen in 2018 and the first half of 2019.
CVE-2019–1367 enables Remote Code Execution (RCE) in the context of Internet explorer in all version from 8, 9, 10 and 11 due to a memory corruption in jscript.dll... Google TAG Team discovered CVE-2019–1367 exploited in the wild by a threat actor.
6 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
TA505 aurait pratiqué un usage ponctuel d’autres rançongiciels (Bart, Jaff, Scarab, Philadelphia, GlobeImposter et GandCrab).
For example, in 2017 TA505 (also known as G0092, GOLD TAHOE) began using GlobeImposter in replacement of Jaff, GandCrab, and Snatch to extend the reach and effectiveness of their campaigns.
Lalartu (AKA Sheriff), a known persona in ransomware since 2019 who played a role in gangs such as GandCrab, REvil, Conti, and others, mentored Basstorlord.
Prior to its development of REvil, the group was associated with an older ransomware family known as Gandcrab.
Storm-0324 has distributed a range of first-stage payloads since at least 2016, including: ... GandCrab ransomware
“…the operators of Gandcrab, GOLD GARDEN, retired and sold their operation to an affiliate group we now call GOLD SOUTHFIELD.”
28 distinct techniques documented for this family, organized by ATT&CK tactic.
Probably the most high-profile attack that GandCrab was behind is a series of infections at customers of remote IT support firms in the month of February.
The GandCrab RaaS is an online portal where crooks sign up and pay to get access to custom builds of the GandCrab ransomware, which they later distribute via email spam, exploit kits, or other means.
A remote attacker is able to exploit a server-side request forgery (SSRF) vulnerability in the WebDAV plugin to send arbitrary HTTP and WebDAV requests from a Confluence Server or Data Center instance.
Reviewing the processes and their command line arguments revealed that the adversary leveraged ScreenConnect remote desktop software to connect and copy a batch file to the target endpoint. Examining one of the cmd.exe processes in Resolver™ showed that the batch file contained a Base64-encoded PowerShell script that was subsequently executed.
Notice that cmd.exe and powershell.exe are both descendants of the ScreenConnect.WindowsClient.exe process.
This Word document contains a macro that downloads and executes the Gandcrab ransomware. | During the course of the campaign, we also saw emails that included VBScript files instead of a ZIP file. The end result is the same, with the payload being pulled off of the server.
The earliest evidence of compromise was detected when several process injection attempts were prevented. Process injection can be used to execute code in the address space of a running process.
GandCrab’s aggressive distribution network was built through its affiliate program and partnerships with other services, such as the binary crypter NTCrypt...
The earliest evidence of compromise was detected when several process injection attempts were prevented. Process injection can be used to execute code in the address space of a running process.
Probably the most high-profile attack that GandCrab was behind is a series of infections at customers of remote IT support firms in the month of February.
With CVE-2018-8120, it tried to steal the system token of the SYSTEM idle process.
GandCrab obtained all processes of the system and searched for the common process names, just like other ransomware families such as Cerber.
GandCrab’s aggressive distribution network was built through its affiliate program and partnerships with other services, such as the binary crypter NTCrypt, along with other actors with expertise in distribution through RDP and VNC.
Crabs only said only 'good work,' admitting that the Romanian antivirus firm had gained access to one of the GandCrab C&C servers from where they took the encryption/decryption keys fair and square.
The malicious actor utilized ScreenConnect remote desktop support software to connect from a compromised MSP to the target enterprise. ScreenConnect was used to copy a batch script to the endpoints, which contained a PowerShell script to download and inject malicious code from Pastebin. | The PowerShell script that was executed checked the processor architecture before utilizing the .NET WebClient class to download content from Pastebin and the Invoke-Expression (IEX) cmdlet to execute code.
These two new GandCrab versions contained the alleged exploit code targeting AhnLab antivirus versions... 'The attack code is inserted in GandCrab 4.21 and 4.3 version, and it is executed after infecting normal files,' AhnLab Director Changkyu Han told Bleeping Computer.
If it detected any of them, it would try to open the process and terminate it using the ‘TerminateProcess’ function.
74 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
122 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware family explicitly linked in the content to Media Land / yalishanda infrastructure.
Related Articles: ... German authorities identify REvil and GandCrab ransomware bosses ...
Prolific ransomware family first seen in early 2018, responsible for significant global financial damage before being succeeded by REvil/Sodinokibi.
A ransomware family operated as a ransomware-as-a-service platform, primarily distributed through spam emails, used for extortion by encrypting data and threatening non-publication/decryption unless ransom was paid.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.