{
  "family": "grandcrab",
  "sample_count": 2,
  "category": "ransomware",
  "description": "Ransomware:Win32/GandCrab (often detected as GrandCrab) is one of the most historically significant Ransomware-as-a-Service (RaaS) operations to ever exist. Active primarily from early 2018 to mid-2019, the GandCrab operators claimed to have extorted over $2 billion before formally announcing their 'retirement.' GandCrab pioneered the highly structured, affiliate-based RaaS business model, where core developers maintained the malware and payment portals, while 'affiliates' were responsible for breaching networks (`T1190`) and deploying the payload in exchange for a percentage of the ransom (`T1486`).<br><br><b>Understanding GandCrab (The Rise of RaaS)</b><br>To an infected organization, GandCrab was devastating, encrypting servers and demanding payment via Dash or Bitcoin on a Tor-hosted portal. For threat intelligence analysts, GandCrab represents the industrialization of ransomware. When the operators 'retired', the affiliate network did not vanish; highly credible evidence suggests the core team and top affiliates immediately transitioned to form the notorious REvil (Sodinokibi) cartel.<br><br><b>Execution and Evasion Mechanics</b><br>Because GandCrab relied on affiliates, the initial access vectors varied wildly: RDP brute-forcing (`T1133`), massive malspam campaigns (often using Emotet or Trickbot loaders) (`T1566.001`), and exploit kits (like RIG and GrandSoft). Once on a network, affiliates utilized tools like Cobalt Strike and BloodHound for lateral movement. The GandCrab executable itself utilized custom packing and 'process hollowing' (`T1055.012`) to evade AV. It terminated database and backup processes (`T1490`) before using Salsa20 and RSA-2048 to encrypt files, appending extensions like `.GDCB`, `.CRAB`, or a randomized string depending on the version.<br><br><b>Indicators of Compromise & Impact</b><br>The impact was catastrophic data loss and severe business interruption. Host-based IoCs include files appended with the GandCrab extensions, the presence of ransom notes (e.g., `GANDCRAB-DECRYPT.txt`), and the execution of commands designed to delete Volume Shadow Copies (`vssadmin.exe delete shadows /all /quiet`). Network IoCs include connections to known GandCrab Tor domains via the Tor proxy network for payment negotiation.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Grandcrab and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Grandcrab is classified as a Ransomware. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Grandcrab establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Grandcrab typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Grandcrab compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Grandcrab should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What cryptographic algorithms and file targeting techniques does Grandcrab employ during execution?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Grandcrab typically leverages hybrid cryptographic architectures combining symmetric stream or block ciphers (such as AES-256 or ChaCha20) for rapid file encryption with asymmetric algorithms (such as RSA-2048 or Curve25519) to securely protect the session keys. It aggressively targets sensitive file extensions including corporate documents, databases, virtual disks, and backups while systematically executing commands to delete Volume Shadow Copies (vssadmin delete shadows /all /quiet) and disable system recovery options."
      }
    },
    {
      "@type": "Question",
      "name": "Are decryptors available for Grandcrab, and what is the recommended recovery procedure?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Decryption availability for Grandcrab depends on whether security researchers or law enforcement (such as the No More Ransom initiative) have recovered the master private keys or discovered flaws in its key generation routines. Victims should never pay the extortion demand, as payment fuels criminal operations without guaranteeing file restoration. The recommended recovery procedure entails isolating infected hosts, conducting forensic disk imaging, identifying the root access vector, and restoring validated systems from immutable offline backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1490",
    "T1486",
    "T1055.012",
    "T1133"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact (The core ransomware payload, constantly updated by the RaaS operators)",
      "tactic": "Impact"
    },
    {
      "id": "T1133",
      "name": "External Remote Services (A primary entry vector for affiliates via exposed RDP)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1490",
      "name": "Inhibit System Recovery (Deleting shadow copies and backups prior to encryption)",
      "tactic": "Impact"
    },
    {
      "id": "T1055.012",
      "name": "Process Injection: Process Hollowing (Used heavily in later versions for defense evasion)",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Immediately isolate infected hosts to prevent lateral movement and the encryption of network shares.",
    "Determine the specific version of GandCrab; free decryptors developed by Bitdefender and Europol (NoMoreRansom) are available for versions 1, 4, and 5 through 5.2.",
    "Conduct a full forensic investigation to determine the affiliate's entry point (e.g., compromised RDP, phishing) to prevent re-infection.",
    "Restore data from offline, immutable backups if a free decryptor is unavailable or fails."
  ],
  "what_to_avoid": [
    "Do not pay the ransom; the operators are formally 'retired', and paying funds organized crime. Use the free decryptors.",
    "Avoid restoring backups without first identifying and closing the initial access vector used by the affiliate."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}