GandCrab Authors Shutdown Operations

GandCrab, a ransomware-as-a-service (RaaS) provider, is shutting down operations and their affiliates and being told to stop distributing the malware. GandCrab gained popularity in January of 2018 when they started to sell their malware as a service on crimeware forums. Two security researchers, Damian and David Montenegro, provided BleepingComputer images of the actors in an article where the operators announced their shutdown. The actors claim to have made close to $2 billion in payments.

Recommendations

• Enable the Cyber Attack Chatter rule to monitor for any GandCrab related traffic on social and dark web channels
• Regularly back up critical information on your information systems to be resilient to Ransomware attacks

Details

The authors claimed to have personally made $150 million dollars from selling their service to cybercriminals. The forum post also outlined that they plan to shut down the payment servers, so victims must pay or they will lose their data forever. The screenshot provided to BleepingComputer shows that they plan to delete their announcement at the end of the month.

The post was made on popular cybercriminal forum exploit.in. The moderator for the forum shut the thread down due to people spamming the thread, and asked the authors to post the decryption keys for the public good.