GandCrab, a new ransomware-as-a-service emerges from Russian crime underground

guest · Oct 22, 2018

mood said: ↑

GandCrab Devs Release Decryption Keys for Syrian Victims
October 17, 2018
https://www.bleepingcomputer.com/ne...s-release-decryption-keys-for-syrian-victims/
Click to expand...

Bitdefender GandCrab decryptor for Syrian users now available
October 22, 2018
https://labs.bitdefender.com/2018/10/bitdefender-gandcrab-decryptor-for-syrian-users-now-available/

We’re happy to announce the release of a new decryptor for victims of GandCrab ransomware. The tool can only be used by a limited pool of victims located in Syria, and works for GandCrab ransomware versions 1 through 5.

At the tool’s core is the roughly 1000 decryption keys deliberately released by the group behind GandCrab and shared with us by BleepingComputer journalist Lawrence Abrams from a dump originally spotted by a malware researcher that goes by the Damian1338B handle.

Our decryption utility – the second one we have released so far to help users get GandCrab encrypted files back – can be downloaded from its product page on Bitdefender Labs. However, there are some things that you should know before you download it:

This tool is built around the decryption keys released by the GandCrab operators themselves. [...] This tool DOES NOT WORK for GandCrab victims located outside Syria. [...]
Click to expand...

Download: https://labs.bitdefender.com/wp-content/uploads/downloads/grandcrab-removal-tool/
Click to expand...

ronjor · Oct 25, 2018

Free decryption tool released for multiple GandCrab ransomware versions

By Catalin Cimpanu for Zero Day | October 25, 2018
New decryption tool can recover files locked by GandCrab versions 1, 4, and 5.
The new decrypter also comes after Bitdefender released a more limited decryption tool earlier this week for GandCrab ransomware victims located in Syria.
Click to expand...

FanJ · Oct 30, 2018

GandCrab: The most popular Multi-Million Dollar Ransomware of the Year - 30 Oct 2018
https://labs.bitdefender.com/2018/1...-multi-million-dollar-ransomware-of-the-year/

Since the most prolific GandCrab ransomware versions are v4 and v5, Bitdefender has been actively working on and collaborating with law enforcement agencies including the Romanian Police, the Directorate for Investigating Organized Crime and Terrorism (DIICOT) and Europol, the FBI, and others, to create a decryption tool that can help victims recover their data. The new Bitdefender GandCrab Ransomware Recovery Tool can successfully decrypt files infected with v4 all the way to v5.0.4 of GandCrab.
Click to expand...

After the release of the free Bitdefender GandCrab Ransomware Recovery Tool, more than 1,700 successful decryptions were registered within hours, essentially saving victims from paying a cumulative amount of over $1 million.
Click to expand...

Victims that have fallen victim to GandCrab version 1, 4, and 5, and have managed to save an image of the affected system, can now download the free Bitdefender GandCrab Ransomware Recovery Tool and start recovering their data, immediately. Also, it’s vital for the original ransom note to be present for the decryption process to work.
Click to expand...

Read more at that Bitdefender site.

See also earlier post in the No More Ransom thread:
https://www.wilderssecurity.com/thr...rces-to-fight-ransomware.387365/#post-2789339

guest · Jan 14, 2019

Heartbreaking Emails: "Love You" Malspam
January 10, 2019
https://isc.sans.edu/forums/diary/Heartbreaking Emails Love You Malspam/24512/

Malicious spam (malspam) using zipped JavaScript (.js) files as email attachments--this is a well-established tactic used by cyber criminals to distribute malware.

Earlier this week, I ran across zipped .js attachments from a wave of malspam. The attachment names all started with Love_You_, and subject lines indicated these were love letters. A quick Twitter search showed this tactic was used to distribute GandCrab ransomware as recently as November 2018. Further research revealed this malspam is associated with the Phorpiex botnet.

The host generated Monero (XMRig) cryptocurrency mining traffic, and it also caused the expected post-infection traffic patterns for GandCrab ransomware. My infected lab host also turned into a spambot for the Phorpiex botnet.
GandCrab ransomware was the most visible aspect of my infected lab host. Of note, the file downloader established itself on a USB thumb drive plugged into the infected host.
Click to expand...

Minimalist · Jan 18, 2019

GandCrab returns with trojans and redundency

The GandCrab ransomware has returned with a new set of trojans in addition to its initial infection.

The addition of new tools comes just over a week after at least one threat actor began using a combination the info stealer Vidar with the ransomware to increase their odds of taking something of value away from their attack.

The latest attacks are using PowerShell as an entry point to deliver the first stage of the attacks rather than for encryption.
Click to expand...

https://www.scmagazine.com/home/sec...trojans-in-addition-to-its-initial-infection/

guest · Jan 24, 2019

Beware of Exit Map Spam Pushing GandCrab v5.1 Ransomware
January 24, 2019
https://www.bleepingcomputer.com/ne...xit-map-spam-pushing-gandcrab-v51-ransomware/

A new malspam campaign pretending to be the current emergency exit map for the recipient's building is being used to install the GandCrab Ransomware. These spam emails contain malicious Word documents that download and install the infection from a remote computer.

According to Myonlinesecurity.co.uk, who discovered this campaign, a server that was previously distributing the Ursnif banking Trojan has now started pushing GandCrab Ransomware v5.1.

These emails state that they are coming from Rosie L. Ashton and have a subject of "Up to datе еmеrgеnсy еxit map"
If the user clicks on the Enable Content button, the Word macros will execute a PowerShell script that downloads and installs the GandCrab v5.1 Ransomware onto the computer.
Unfortunately, it is not possible to decrypt files encrypted by GandCrab [...]
Click to expand...

Minimalist · Jan 30, 2019

“Love you” malspam gets a makeover for massive Japan-targeted campaign

While finishing our analysis on a recent surge in malicious spam targeting Russia, we noticed another, unrelated, JavaScript-fueled campaign reaching new heights in our telemetry. Apparently, the “Love You” malspam campaign from mid-January 2019 has been modified and hit Japan.

Based on our telemetry data, this latest “Love you” campaign was launched on January 28, 2019, almost doubling in size compared to the initial waves, as seen in Figure 1. Much like in mid-January, the spam emails distribute a cocktail of malicious payloads, with some updates: we have seen attempts to download a cryptominer, a system settings changer, a malicious downloader, the Phorpiex worm, and the infamous ransomware GandCrab version 5.1.
Click to expand...

https://www.welivesecurity.com/2019/01/30/love-you-malspam-makeover-massive-japan-targeted-campaign/

guest · Feb 3, 2019

mood said: ↑

Beware of Exit Map Spam Pushing GandCrab v5.1 Ransomware
January 24, 2019
https://www.bleepingcomputer.com/ne...xit-map-spam-pushing-gandcrab-v51-ransomware/
Click to expand...

Godaddy DNS system still compromised to deliver yet another Gandcrab Ransomware campaign
February 2, 2019
https://myonlinesecurity.co.uk/goda...ver-yet-another-gandgrab-ransomware-campaign/

Last week we reported on a fairly large scale Gandcrab ransomware campaign that was assisted in delivery via a security hole in Godaddy (and almost certainly other major DNS providers).

Some of the major tech sites reported on the DNS compromise with a message that Godaddy was aware of it & was “fixing” the problem. Well 10 days later it still isn’t fixed and the criminals are continuing to use the “exploit”, Misconfiguration, or security hole in Godaddy DNS system.

To further exacerbate the problem, quite a large number of people, especially companies, purchase a domain name, either never use it or have used it but no longer need it, but keep it registered to prevent a competitor or anybody else using it.
What makes these malware laden emails much more likely to be delivered is the fact that the sending domains all have a good reputation. There are dozens, if not hundreds of domains involved in this particular campaign. Almost all the domains have been registered for many years, some for more than 10 years.
Click to expand...

Update 3 February 2019: I have heard back from a member of Godaddy Security team, who assures me the misconfiguration was fixed last week to prevent further usage of the vulnerability, but some dangling domains that had already been added to a miscreant’s account were missed. They are now reviewing & searching again to hopefully finally clear up the situation and prevent any further occurrence.
Click to expand...

guest · Feb 6, 2019

GandCrab Ransomware Helps Shady Data Recovery Firms Hide Ransom Costs
February 6, 2019
https://www.bleepingcomputer.com/ne...-shady-data-recovery-firms-hide-ransom-costs/

The GandCrab ransomware TOR site allows shady data recovery companies to hide the actual ransom cost from victims and it is currently being disseminated through a large assortment of distribution channels according to a Codeware report.

The ransomware's TOR site comes with a hidden private chat that can be enabled using one of the "discount" codes, allowing dishonest data recovery firms to hide the final cost of the GandCrab decryption process from its customers.
According to Codeware, "After entering the code, the applicable discount is displayed and the USD ransom amount on the payment pages is automatically adjusted. Discounts range from 5-20% depending on the size of the ransom."
Click to expand...

guest · Feb 8, 2019

Mail Attachment Builds Ransomware Downloader from Super Mario Image
February 8, 2019
https://www.bleepingcomputer.com/ne...ransomware-downloader-from-super-mario-image/

A malicious spreadsheet has been discovered that builds a PowerShell command from individual pixels in a downloaded image of Mario from Super Mario Bros. When executed, this command will download and install malware such as the GandCrab Ransomware and other malware.

These emails contain an attachment with names similar to "F.DOC.2019 A 259 SPA.xls" that when opened tell the user to Enable Content in order to properly view the document.
If they are located in Italy, though, the following image of Mario is downloaded. The image below has been slightly modified so that it cannot be used for malicious purposes.

According to researchers from Bromium who analyzed this attack, after the image is downloaded the script will extract various pixels from the image to reconstruct a PowerShell command, which will then be executed.
"The above code is finding the next level of code from the blue and green channel from pixels in a small region of the image," stated Bromium's research. "The lower bits of each pixel are used as adjustments to these and yield minimal differences to the perceived image. Running this presents yet more heavily obfuscated PowerShell"
Click to expand...

guest · Feb 19, 2019

Bitdefender: New GandCrab v5.1 Decryptor Available Now
February 19, 2019
https://labs.bitdefender.com/2019/02/new-gandcrab-v5-1-decryptor-available-now/

Today we’re happy to announce that our collaboration with the Romanian Police, Europol and other law enforcement agencies has yielded another new decryptor for all GandCrab ransomware versions released since October 2018.
If you need to decrypt versions 1, 4 and up through 5.1, then download and run our brand new tool:

https://labs.bitdefender.com/wp-content/uploads/downloads/gandcrab-removal-tool-v1-1/

While this is the third time we have defeated GandCrab encryption in the past year, our celebration will be short-lived. We’ll be back to work tomorrow, as GandCrab operators will no doubt change tactics and techniques.
Click to expand...

itman · Feb 19, 2019

mood said: ↑

Bitdefender: New GandCrab v5.1 Decryptor Available Now
Click to expand...

Unfortunately always one step behind since a new undecrypted 5.2 version has been released:

Bitdefender confirmed that there is a new GandCrab variant for which no decryption tool exists. This is not unexpected, as its operators are constantly looking for new ways to maintain and expand their business.
Click to expand...

https://www.bleepingcomputer.com/ne...available-for-v51-new-52-variant-already-out/

guest · Feb 21, 2019

itman said: ↑

Unfortunately always one step behind since a new undecrypted 5.2 version has been released:

https://www.bleepingcomputer.com/ne...available-for-v51-new-52-variant-already-out/
Click to expand...

GandCrab Ransomware Affiliates Continue to Push Decryptable Versions
February 21, 2019
https://www.bleepingcomputer.com/ne...liates-continue-to-push-decryptable-versions/

Yesterday, we reported that BitDefender made a GandCrab decrypter available for versions 4 through 5.1. Soon after the tool was released, the ransomware developers released a new 5.2 version, which is no longer decryptable.

While the GandCrab developers may be quick to react to new developments, there affiliates seem to be slower. This is because, at least one affiliate is continuing to distribute the older 5.1 version that is decryptable, rather than switching to the new 5.2 version, which is not.
If you become infected with GandCrab, be sure to check the version number. If it is 5.1 or earlier, then you can use the BitDefender GandCrab decrypter to get your files back for free.
Click to expand...

guest · Mar 6, 2019

PINCHY SPIDER Affiliates Adopt “Big Game Hunting” Tactics to Distribute GandCrab Ransomware
March 6, 2019
https://www.crowdstrike.com/blog/pinchy-spider-adopts-big-game-hunting/

PINCHY SPIDER is the criminal group behind the development of the ransomware most commonly known as GandCrab, which has been active since January 2018. PINCHY SPIDER sells access to use GandCrab ransomware under a partnership program with a limited number of accounts
GandCrab Identified by CrowdStrike Intel
CrowdStrike Intelligence first identified new GandCrab ransomware deployment tactics in mid-February, when a threat actor was observed performing actions on a victim host in order to install GandCrab.
Using RDP and stolen credentials from the initially compromised host, the threat actor then proceeded to move laterally around the victim network and was able to deploy GandCrab across several other hosts.
Expanding to Adopt “Big Game Hunting” Tactics
The change in deployment tactics observed in these recent incidents, coupled with PINCHY SPIDER’s advertising for individuals with skills in RDP/VNC and experience in corporate networking, suggest PINCHY SPIDER and their affiliates are expanding to adopt big game hunting tactics.
Click to expand...

guest · Mar 14, 2019

Chinese Government Officials Face Ransomware Attack
March 14, 2019
https://news.bitcoin.com/chinese-government-ransomware-north-korea/

A statement issued by a Chinese provincial government website has announced that the National Network and Information Security Information Center has identified overseas hackers targeting the websites of government departments with emails containing ransomware.

The ransomware was delivered via an email containing the subject line: “You must report to the police at 3:00 pm on March 11!” The emails contain version 5.2 of the Gandcrab malware, which is concealed in an attachment named “03-11-19.rar.”
The scale of the attack is not currently known, however a number of hard drives belonging to government officials have been infected.
Click to expand...

guest · Apr 23, 2019

Gandcrab — the Most Prevalent Ransomware in 2019
April 22, 2019
https://hackernoon.com/gandcrab-the-most-prevalent-ransomware-in-2019-933a722bb42d

With the first infection instances documented in January 2018, this lineage quickly gained traction and came to dominate the extortion landscape.
Then came editions that blemished files with the .CRAB and .KRAB strings, superseded by a series of the pest’s personas using random victim-specific extensions.

As of March 2019, the GandCrab family has spawned 9 distinct variants along with subversions and reached v5.2. Courtesy of Bitdefender that recently released a free decryptor supporting iterations up to 5.1.
However, the infection in its current form is not decryptable this way, proving that researchers are always one step behind. [...]
Conclusion
GandCrab is currently the world’s top ransomware menace that’s thriving and evolving despite all efforts of security think tanks. Although the achievements in restoring hostage data are significant and absolutely commendable, the malefactors always have new tricks up their sleeve to outstrip the analysts.
Click to expand...

guest · Apr 25, 2019

GandCrab attackers exploit recently patched Confluence vulnerability
If your company uses Confluence, make sure you have the latest available patches for this vulnerability
April 24, 2019
https://www.itworld.com/article/339...ecently-patched-confluence-vulnerability.html

A group of attackers are actively exploiting a critical vulnerability in Atlassian's Confluence collaboration software to infect servers with the GandCrab ransomware.
The vulnerability, tracked as CVE-2019-3396, is in the software's Widget Connector that allows users to embed content from YouTube, Twitter and other websites into web pages.

According to a new report from security firm Alert Logic, proof-of-concept exploit code for the vulnerability was released publicly on April 10 and malicious hackers wasted no time adopting it in attacks.
"Within a week of the first exploit code appearing within our data lake we saw the first set of breached customers," the Alert Logic researchers said.

The malicious payload deployed by hackers on compromised Confluence servers downloads a malicious PowerShell script and executes it on the system. That script then downloads a customized version of an open-source PowerShell post-exploitation agent called Empire from a Pastebin page.
Click to expand...

"This re-emergence of ransomware as the outcome of an unauthenticated remote code execution vulnerability may be an opportunist use of ransomware instead of cryptominers due to the nature of the vulnerability being used," the Alert Logic researchers said.
"[...] The attackers may be making a judgement call that the likelihood of pay-out is a sufficiently higher return than could be expected mining cryptocurrency on the host."
Click to expand...

guest · May 7, 2019

GandCrab Ransomware Detected Targeting Manufacturing Firm
May 7, 2019
https://www.securityweek.com/gandcrab-ransomware-detected-targeting-manufacturing-firm

Now Cybereason has detected a new example, with a new evasive infection chain, with GandCrab targeting an unnamed Japanese manufacturing business.
At the time of the attack against the Japanese firm, there is no way to recover GandCrab encrypted files without paying the ransom (or recovering from backups).

This new attack starts with a poisoned Korean Office document. The poison is an embedded and obfuscated macro that is triggered by GotFocus. A multi-stage downloader is decrypted resulting a WMI object that spawns a cmd.exe instance with more commands. It produces an INF configuration file that uses a variation of the Squiblydoo technique (using cmstp.exe) to bypass Windows AppLocker. [...]

The relatively new use of GandCrab against business is not an indication of a change of policy from the developers. Since leasing the ransomware is a service they offer, it is still available to the less skilled hackers who use spray and pray delivery against consumers.
"Also, since GandCrab is a RaaS model, the threat actors who 'lease' the service, can target whomever they want. So, it's difficult to assign collective intention/trend, since we are talking about an unknown number of potential threat actors," [...]
Click to expand...

Cybereason: GandCrab's new Evasive Infection Chain

guest · May 25, 2019

Hackers are scanning for MySQL servers to deploy GandCrab ransomware
May 24, 2019
https://www.zdnet.com/article/hackers-are-scanning-for-mysql-servers-to-deploy-gandcrab-ransomware/

These attacks are somewhat unique, as cyber-security firms have not seen any threat actor until now that has attacked MySQL servers running on Windows systems to infect them with ransomware.
Andrew Brandt, Principal Researcher at Sophos, and the one who spotted these new attacks in a honeypot's logs described them as "a serendipitous discovery" in an email to ZDNet.
ATTACKERS TARGET RARE, BUT JUICY, EXPOSED MYSQL DBS
Brandt said hackers would scan for internet-accessible MySQL databases that would accept SQL commands, check if the underlying server would run on Windows, and then use malicious SQL commands to plant a file on the exposed servers, which they'd later execute, infecting the host with the GandCrab ransomware.

While most system administrators typically protect their MySQL servers with passwords, the purpose of these scans appeared to be the opportunistic exploitation of misconfigured or passwordless databases.
As Brandt points out, these types of attacks are very rare. Hacker groups usually scan for database servers to infiltrate companies and to steal their data or intellectual property, or to plant crypto-mining malware [1, 2].
Click to expand...

guest · Jun 17, 2019

Just released: fourth decryption tool neutralises latest version of GandCrab ransomware
June 17, 2019
https://www.europol.europa.eu/newsr...ralises-latest-version-of-gandcrab-ransomware

On 17 June, a new decryption tool for the latest version of the most prolific ransomware family GandCrab has been released free of charge on www.nomoreransom.org.
This tool allows victims of ransomware to regain access to their information encrypted by hackers, without having to pay demanded ransoms. The tool is released in partnership with law enforcement agencies [...]
Click to expand...

BDGandCrabDecryptTool Decryptor is designed to decrypt files encrypted by GandCrab (V1, V4 and V5 up to V5.2 versions) Ransom:
http://download.bitdefender.com/am/malware_removal/BDGandCrabDecryptTool.exe

guest · Jul 16, 2019

FBI Releases Master Decryption Keys for GandCrab Ransomware
July 16, 2019
https://www.bleepingcomputer.com/ne...ster-decryption-keys-for-gandcrab-ransomware/

In an FBI Flash Alert, the FBI has released the master decryption keys for the Gandcrab Ransomware versions 4, 5, 5.0.4, 5.1, and 5.2. Using these keys, any individual or organization can create and release their very own GandCrab decryptor.
FBI lets anyone create a GandCrab decryptor
In a "FBI Flash Alert" shared with BleepingComputer, three master decryption keys for the GandCrab Ransomware were released to members of the FBI's InfraGard program.
GandCrab master decryption keys
Below are the master decryption keys for GandCrab versions 4, 5, 5.0.4, 5.1, and 5.2 [...]
Click to expand...

Log in or Sign up

GandCrab, a new ransomware-as-a-service emerges from Russian crime underground

guest Guest

ronjor Global Moderator

FanJ Updates Team

guest Guest

Minimalist Registered Member

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

itman Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

GandCrab, a new ransomware-as-a-service emerges from Russian crime underground

guest Guest

ronjor Global Moderator

FanJ Updates Team

guest Guest

Minimalist Registered Member

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

itman Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches