Netskope Threat Labs

GandCrab

ATP Sandbox Adv. HeuristicsAVNetskope IPS

Description

GandCrab is a ransomware as a service operation that operated from 2018 to 2019 and claimed to have extracted more than two billion dollars from its victims. It pioneered aggressive affiliate recruitment, constant version updates, and ransom payments in cryptocurrency, and it spread through spam, exploit kits, and compromised remote services. The operators announced their retirement in mid 2019, and their business model shaped the RaaS operations that dominate today.

Stats

First seen
January 2022
Last seen
October 2026

Alert name variants

Alert Name
Binary.Ransomware.GandCrab
ByteCode-MSIL.Ransomware.GandCrab
DOS.Ransomware.GandCrab
Dump:Generic.Ransom.GandCrab.448390BA
Dump:Generic.Ransom.GandCrab.CDD38812
Dump:Trojan.Ransom.GandCrab.E
Gen:Variant.Ransom.GandCrab.1249
Gen:Variant.Ransom.GandCrab.1284
Gen:Variant.Ransom.GandCrab.143
Gen:Variant.Ransom.GandCrab.1506

Related IPS Signatures

Signature Name
MALWARE-CNC Win.Ransomware.GandCrab outbound connection

References