{
  "family": "grandcrab",
  "sample_count": 2,
  "category": "ransomware",
  "description": "Ransomware:Win32/GandCrab (often detected as GrandCrab) is one of the most historically significant Ransomware-as-a-Service (RaaS) operations to ever exist. Active primarily from early 2018 to mid-2019, the GandCrab operators claimed to have extorted over $2 billion before formally announcing their 'retirement.' GandCrab pioneered the highly structured, affiliate-based RaaS business model, where core developers maintained the malware and payment portals, while 'affiliates' were responsible for breaching networks (`T1190`) and deploying the payload in exchange for a percentage of the ransom (`T1486`).<br><br><b>Understanding GandCrab (The Rise of RaaS)</b><br>To an infected organization, GandCrab was devastating, encrypting servers and demanding payment via Dash or Bitcoin on a Tor-hosted portal. For threat intelligence analysts, GandCrab represents the industrialization of ransomware. When the operators 'retired', the affiliate network did not vanish; highly credible evidence suggests the core team and top affiliates immediately transitioned to form the notorious REvil (Sodinokibi) cartel.<br><br><b>Execution and Evasion Mechanics</b><br>Because GandCrab relied on affiliates, the initial access vectors varied wildly: RDP brute-forcing (`T1133`), massive malspam campaigns (often using Emotet or Trickbot loaders) (`T1566.001`), and exploit kits (like RIG and GrandSoft). Once on a network, affiliates utilized tools like Cobalt Strike and BloodHound for lateral movement. The GandCrab executable itself utilized custom packing and 'process hollowing' (`T1055.012`) to evade AV. It terminated database and backup processes (`T1490`) before using Salsa20 and RSA-2048 to encrypt files, appending extensions like `.GDCB`, `.CRAB`, or a randomized string depending on the version.<br><br><b>Indicators of Compromise & Impact</b><br>The impact was catastrophic data loss and severe business interruption. Host-based IoCs include files appended with the GandCrab extensions, the presence of ransom notes (e.g., `GANDCRAB-DECRYPT.txt`), and the execution of commands designed to delete Volume Shadow Copies (`vssadmin.exe delete shadows /all /quiet`). Network IoCs include connections to known GandCrab Tor domains via the Tor proxy network for payment negotiation.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1490",
    "T1486",
    "T1055.012",
    "T1133"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact (The core ransomware payload, constantly updated by the RaaS operators)",
      "tactic": "Impact"
    },
    {
      "id": "T1133",
      "name": "External Remote Services (A primary entry vector for affiliates via exposed RDP)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1490",
      "name": "Inhibit System Recovery (Deleting shadow copies and backups prior to encryption)",
      "tactic": "Impact"
    },
    {
      "id": "T1055.012",
      "name": "Process Injection: Process Hollowing (Used heavily in later versions for defense evasion)",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Immediately isolate infected hosts to prevent lateral movement and the encryption of network shares.",
    "Determine the specific version of GandCrab; free decryptors developed by Bitdefender and Europol (NoMoreRansom) are available for versions 1, 4, and 5 through 5.2.",
    "Conduct a full forensic investigation to determine the affiliate's entry point (e.g., compromised RDP, phishing) to prevent re-infection.",
    "Restore data from offline, immutable backups if a free decryptor is unavailable or fails."
  ],
  "what_to_avoid": [
    "Do not pay the ransom; the operators are formally 'retired', and paying funds organized crime. Use the free decryptors.",
    "Avoid restoring backups without first identifying and closing the initial access vector used by the affiliate."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}