{ "id": "b0779b5e-78bb-419d-9594-913e69ceda5b", "created_at": "2026-04-06T00:16:10.684836Z", "updated_at": "2026-04-10T03:21:20.534212Z", "deleted_at": null, "sha1_hash": "5b99afc798fcb3e9824db61db452a01b72afd05a", "title": "GandCrab ransomware operation says it's shutting down", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 796568, "plain_text": "GandCrab ransomware operation says it's shutting down\r\nBy Written by Catalin Cimpanu, ContributorContributor June 1, 2019 at 2:22 a.m. PT\r\nArchived: 2026-04-05 13:45:23 UTC\r\nSee als\r\nThe creators of the GandCrab ransomware announced yesterday they were shutting down their Ransomware-as-a-Service (RaaS) operation, ZDNet has learned.\r\nThe GandCrab RaaS is an online portal where crooks sign up and pay to get access to custom builds of the\r\nGandCrab ransomware, which they later distribute via email spam, exploit kits, or other means.\r\nWhen an infected user pays a ransom demand, the original GandCrab author earns a small commission, while the\r\nrest of the money goes to the crook who distributed the ransomware.\r\nRetirement plans\r\nYesterday night, a source in the malware community has told ZDNet that the GandCrab RaaS operator formally\r\nannounced plans to shut down their service within a month.\r\nThe announcement was made in an official thread on a well-known hacking forum, where the GandCrab RaaS has\r\nadvertised its service since January 2018, when it formally launched.\r\nIn the forum message, the GandCrab authors bragged about the ransomware having earned over $2 billion in\r\nransom payments, with the operators making roughly $2.5 million per week and $150 million per year. It goes\r\nwithout saying that these numbers should be taken with a grain of salt.\r\n\"We successfully cashed this money and legalized it in various spheres of white business both in real life and on\r\nthe Internet,\" the GandCrab crew bragged.\r\nhttps://www.zdnet.com/article/gandcrab-ransomware-operation-says-its-shutting-down/\r\nPage 1 of 3\n\n\"We are leaving for a well-deserved retirement,\" they said. \"We have proved that by doing evil deeds, retribution\r\ndoes not come.\"\r\nGandCrab forum ad\r\nOur source tells ZDNet that this was the last step in a process that started earlier this week when the GandCrab\r\ncrew announced RaaS customers via private emails about plans to shut down the service.\r\nRenters of the GandCrab ransomware were told to wind down operations and cash out within the next month.\r\nPlans to delete decryption keys\r\nThe forum thread also leaves an ominous message for GandCrab victims, as the GandCrab RaaS operators said\r\nthey were planning to delete all decryption keys, making file recovery for infected victims impossible.\r\nSome of the security researchers we approached have told ZDNet this could be a ploy to make victims panic and\r\npay the ransom demand. However, they shifted their views when they learned that GandCrab RaaS customers\r\nwere also told to wind down operations.\r\nIn the past, when ransomware operations have shut down, they usually tended to release all victim decryption keys\r\nfor free so that users could recover their data. Something like this happened for victims of ransomware families\r\nsuch as TeslaCrypt, XData, Crysis, and FilesLocker.\r\nEven the GandCrab crew showed some compassion in the past by releasing free decryption keys for all users\r\ninfected in war-torn Syria.\r\nGandCrab was on the decline\r\nA chart shared with ZDNet by Michael Gillespie -- the creator of ID-Ransomware, a service that lets ransomware\r\nvictims identify the type of ransomware that has infected their systems -- shows a steady decline in GandCrab\r\nactivity this month.\r\nGandCrab IDR stats\r\nImage: Michael Gillespie\r\nThe chart shows that GandCrab was losing customers even before the shutdown announcement.\r\nSecurity\r\nOver the past year, the GandCrab ransomware family has been one of the most active ransomware threats around.\r\nIt was one of the few ransomware strains that were being mass-distributed via email spam and exploit kits, but\r\nhttps://www.zdnet.com/article/gandcrab-ransomware-operation-says-its-shutting-down/\r\nPage 2 of 3\n\nalso as part of targeted attacks against high-profile organizations (a tactic known as big-game hunting) at the same\r\ntime.\r\nThe ransomware has seen frequent updates and is currently at version 5.2, at the time of today's shutdown.\r\nCyber-security firm Bitdefender released GandCrab decryptors on three occasions over the past year. These are\r\napps that allow victims to recover encrypted files without paying the ransom. The last one was released in\r\nFebruary this year and could decrypt GandCrab versions up to version 5.1 (with the exemption of v2 and v3).\r\nThe GandCrab author also had a spat with South Korean security vendor AhnLab last summer after the security\r\nfirm released a vaccine for the GandCrab ransomware. As retaliation, they included a zero-day for the AhnLab\r\nantivirus in the GandCrab code.\r\nRecently, Sophos Labs has observed criminal groups scanning the internet for open MySQL databases running on\r\nWindows systems, which they tried to infect with GandCrab. Probably the most high-profile attack that GandCrab\r\nwas behind is a series of infections at customers of remote IT support firms in the month of February.\r\nIf the GandCrab crew follows through on their plans and actually shuts down, their legacy remains as one of a\r\nransomware strain that has dominated the ransomware landscape in the second half of 2018 and the first half of\r\n2019, when it was, by far, the most active strain on the market.\r\nCybercrime and malware, 2019 predictions\r\nRelated malware and cybercrime coverage:\r\nEmotet is dominating the malicious threat landscape in 2019\r\nCEO who sold encrypted phones to criminal gangs gets nine years in prison\r\nNew HiddenWasp malware found targeting Linux systems\r\nHackers are scanning for MySQL servers to deploy GandCrab ransomware\r\nI2P network proposed as the next hiding spot for criminal operations\r\nCompany behind LeakedSource pleads guilty in Canada\r\nThe dark web is smaller, and may be less dangerous, than we think TechRepublic\r\nGame of Thrones has the most malware of any pirated TV show CNET\r\nSource: https://www.zdnet.com/article/gandcrab-ransomware-operation-says-its-shutting-down/\r\nhttps://www.zdnet.com/article/gandcrab-ransomware-operation-says-its-shutting-down/\r\nPage 3 of 3", "extraction_quality": 1, "language": "EN", "sources": [ "ETDA" ], "references": [ "https://www.zdnet.com/article/gandcrab-ransomware-operation-says-its-shutting-down/" ], "report_names": [ "gandcrab-ransomware-operation-says-its-shutting-down" ], "threat_actors": [], "ts_created_at": 1775434570, "ts_updated_at": 1775791280, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/5b99afc798fcb3e9824db61db452a01b72afd05a.pdf", "text": "https://archive.orkl.eu/5b99afc798fcb3e9824db61db452a01b72afd05a.txt", "img": "https://archive.orkl.eu/5b99afc798fcb3e9824db61db452a01b72afd05a.jpg" } }