Gandcrabransomware was first detected in January 2018 and is the most advanced and ever-changing ransomware. The hackers behind the ransomware have released five different versions in over a year.
Gandcrab spread through many different methods such as malicious emails, exploit kits, social engineering methods, and other malware campaigns.
According to researchers Damian and David Montenegro, the hackers behind Gandcrab have announced that they are going to stop the attacks.
It is worth noting that hackers have earned more than $2 billion from the ransoms they demanded. Therefore, each hacker, individually, has earned more than $150 million annually.
After obtaining such large sums of money, it is logical that they stopped the attacks, while they also asked their partners to stop distributing the ransomware within 20 days.
Additionally, they urge victims to pay the ransom, otherwise the decryption key will be deleted. It is not yet clear whether the hackers will publish the keys after the shutdown.
GandCrab Ransomware Versions
GandCrab v1 – Discovered in January 2018, distributed via exploit kits such as RIG EK and GrandSoft EK. Ransom is collected in DASH crypto-currency. Encrypts files and adds .gdcb extension.
GandCrab v2 – The ransomware is distributed via spam emails and adds a .CRAB extension to encrypted files.
GandCrab v3 – The next version comes with the ability to change the desktop wallpaper with ransomware notes. This version of the ransomware also adds the .CRAB extension to encrypted files.
GandCrab v4 – The fourth version adds a .KRAB extension instead of CRAB and uses the Tiny Encryption Algorithm to evade detection. It is distributed via fake software crack sites.
GandCrab v5 – Adds a 5-character extension to encrypted files and after the encryption process, creates HTML ransom notes that show files, documents, photos being encrypted.
Ransomware has always been a threat to cyber professionals, with new variants and types developing daily.
attacks Ransomware will continue to increase in numbers, but not all of them are capable of lasting long. In January 2017, there were 635 attacks, in February 2018 it was 1105, and in January 2019 it was 1453.
