Gandcrab

Overview

GandCrab is a landmark ransomware family that revolutionized the modern cyber extortion industry by pioneering and popularizing the Ransomware-as-a-Service (RaaS) affiliate model. First appearing on underground cybercrime forums in January 2018, GandCrab was developed and maintained by an elite cybercrime group known as PINCHY SPIDER. The operators recruited vetted affiliates through Russian-language forums like Exploit.in and XSS, granting them customized builds and management panels in exchange for a 20% to 30% cut of all extorted ransom payments. Between January 2018 and June 2019, GandCrab underwent rapid, aggressive technological iteration spanning versions v1 through v5.2. The ransomware integrated sophisticated anti-analysis techniques, process termination routines targeting database and backup services (`sql.exe`, `oracle.exe`, `vssadmin.exe`), and multi-threaded file encryption using RSA-2048 and Salsa20 cryptographic algorithms. Affiliates distributed GandCrab through an array of exploit kits (Rig, GrandSoft, Fallout), spear-phishing campaigns with malicious Word documents, and brute-force Remote Desktop Protocol (RDP) intrusions. In May 2019, the operators announced their 'retirement' on underground forums, publicly boasting that they had extorted more than $2 billion in ransom payments and laundered their profits into legitimate businesses. However, threat intelligence researchers and law enforcement quickly established that the core PINCHY SPIDER development team did not retire; rather, they restructured their operation to launch REvil (Sodinokibi), utilizing a directly inherited codebase to execute high-profile enterprise big-game hunting.

Known aliases

Threat reports may refer to this family under multiple names:

• GandCrab
• GandCrab v1-v5.2
• GDCB

Threat Actor Attribution

Attribution is probabilistic, not a science. Each link below states its confidence level and the evidence behind it.

• PINCHY SPIDER (Core Group) / Ancestor to REvil (Sodinokibi) High confidence
  Basis: Operated by the Russian-speaking cybercriminal group PINCHY SPIDER on top-tier underground forums. Code analysis confirms that GandCrab's codebase directly evolved into the REvil (Sodinokibi) ransomware. [source]

Family Pedigree & Lineage

Malware authors regularly fork and iterate upon existing codebases. Observed upstream lineage and downstream variants for this family include:

Known Derivatives & Downstream Variants: Gandcrab V1 · Gandcrab V2 · Gandcrab V3 · Gandcrab V4 · Gandcrab V5.0.4 · Gandcrab V5.2 · Revil (Successor)

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1059.003: Restrict execution of Windows Command Shell (cmd.exe) and block unauthorized batch scripts.
• T1566.001: Scan email attachments for malicious macros, scripts, or suspicious archive files.

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Exploited Vulnerabilities (CVEs)

This malware family is documented weaponizing the following common vulnerabilities and exposures:

• CVE-2018-0886 — In-depth exploitation analysis and catalog intelligence (NIST NVD ↗).
• CVE-2018-8174 — In-depth exploitation analysis and catalog intelligence (NIST NVD ↗).

Command & Control (C2) and Network Profile

How this family talks to its operators. C2 traffic can often identify a family even when its code and configuration are hard to analyse. Ports and patterns are historical and change between campaigns, so use them as hunting leads rather than block-only rules.

Network detection ideas

• Detect execution of vssadmin.exe delete shadows and bcdedit commands disabling recovery
• Inspect outbound connections to known Tor gateway nodes and .onion domains
• Flag rapid encryption and renaming of network share files to random extensions (e.g. .gdcb, .crab, .[random])

Sources: CISA Alert AA21-209A: Ransomware Affiliates (GandCrab & Sodinokibi), Bitdefender / Europol GandCrab Decryptor Initiative

Indicators of Compromise

Public indicators drawn from CISA advisories and vendor reporting. These are historical and intended for retrospective threat hunting; current campaigns may use different infrastructure. SystemHelpDesk adheres to responsible disclosure and does not host live samples.

File hashes (SHA-256, sample)

Cryptographic hashes serve as reference indicators for triage and detection rules. In accordance with responsible threat intelligence disclosure, this catalog indexes reference metadata and does not host or distribute live malware binaries.

• 23a9eeec841e06fa99e90059c1187428f5c88b7bc2d44933dd2a4bbdfec3bf92
• 37df32a84393ce0ff5b0d0c3eb15220c58e1465608034a7fbff25ad0f5d02636

Delivery vectors

• Spear-phishing emails containing malicious macros or PDF attachments exploiting CVE-2018-8174
• Drive-by compromises via Rig and Fallout exploit kits targeting unpatched browser plugins
• Brute-force compromise of exposed Remote Desktop Protocol (RDP) servers

Persistence mechanisms

• Registry Run keys in HKCU\Software\Microsoft\Windows\CurrentVersion\Run referencing dropped binaries
• Scheduled tasks created under names masquerading as Windows Update services

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_GANDCRAB_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gandcrab"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "gandcrab" ascii wide nocase
        $s2 = "gandcrab" ascii wide nocase
        $s3 = "gandcrab v1-v5.2" ascii wide nocase
        $s4 = "gdcb" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Gandcrab (Ransomware) Execution & Triage
id: 53ece1ba-744d-5ec9-bd69-bccbc38a77c4
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Gandcrab malware family. Detects volume shadow copy deletion, boot status
  tampering, and recovery inhibition characteristic of modern ransomware operations.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/gandcrab
- https://malware-families-catalog.systemhelpdesk.com/defensive/ransomware-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.ransomware
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1486
- attack.t1489
- attack.t1490
- attack.t1082
- attack.t1059_003
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \vssadmin.exe
    - \wmic.exe
    - \wbadmin.exe
    - \bcdedit.exe
    CommandLine|contains:
    - delete shadows
    - shadowcopy delete
    - resize shadowstorage
    - recoveryenabled no
    - ignoreallfailures
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: critical

rule MALWARE_WIN_GANDCRAB_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gandcrab tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "gandcrab" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Disconnect infected devices from the network immediately to prevent lateral spread and network share encryption.
2. Verify what version of GandCrab infected the host (versions v1, v4, and v5.0.4-v5.1 have free decryptors available through No More Ransom).
3. Preserve encrypted files and ransom notes for key validation against available law enforcement decryptor keys.
4. Inspect exposed RDP ports and enforce multi-factor authentication across all external access points.
5. Restore systems from verified offline, immutable backups.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not pay ransom demands without checking the No More Ransom portal first, as multiple versions have public decryptors.
2. Do not allow RDP services to remain exposed directly to the public internet without a VPN and MFA.

References & External Analysis

• Malwarebytes: GandCrab ransomware
• CISA Advisory: CISA Alert AA21-209A (Ransomware Affiliates: From GandCrab to Sodinokibi)
• Search "gandcrab" on VirusTotal (External Analysis)
• Search "gandcrab" on Any.Run (Sandbox Sandbox)
• Search "gandcrab" on MalwareBazaar (Malware Samples)

North American Authority Advisory (CISA / NIST)

The Cybersecurity and Infrastructure Security Agency (CISA) has published an official US federal advisory on this family, which can be mapped to NIST Cybersecurity Framework (CSF) incident response controls: CISA Alert AA21-209A (Ransomware Affiliates: From GandCrab to Sodinokibi) ↗

Frequently Asked Questions

Related Threats (Category: Ransomware)

Explore other documented threats in the same operational category:

• Shopperpro
• Bkff
• Oligo
• Deliric
• 0Y1A48Lx2Yib
• Xdata
• Delbar
• Umgfxgkazyg

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/gandcrab.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.