GandCrab ransomware operation says it's shutting down

guest · Jun 1, 2019

GandCrab ransomware operation says it's shutting down
GandCrab crew says it made enough money and plans to retire within a month
June 1, 2019
https://www.zdnet.com/article/gandcrab-ransomware-operation-says-its-shutting-down/

The creators of the GandCrab ransomware announced yesterday they were shutting down their Ransomware-as-a-Service (RaaS) operation, ZDNet has learned.
The GandCrab RaaS is an online portal where crooks sign up and pay to get access to custom builds of the GandCrab ransomware, which they later distribute via email spam, exploit kits, or other means.
RETIREMENT PLANS
In the forum message, the GandCrab authors bragged about the ransomware having earned over $2 billion in ransom payments, with the operators making roughly $2.5 million per week and $150 million per year.

"We are leaving for a well-deserved retirement," they said. "We have proved that by doing evil deeds, retribution does not come."
PLANS TO DELETE DECRYPTION KEYS
The forum thread also leaves an ominous message for GandCrab victims, as the GandCrab RaaS operators said they were planning to delete all decryption keys, making file recovery for infected victims impossible.
Click to expand...

guest · Jul 8, 2019

Who’s Behind the GandCrab Ransomware?
July 8, 2019
https://krebsonsecurity.com/2019/07/whos-behind-the-gandcrab-ransomware/

The crooks behind an affiliate program that paid cybercriminals to install the destructive and wildly successful GandCrab ransomware strain announced on May 31, 2019 they were terminating the program after allegedly having earned more than $2 billion in extortion payouts from victims. What follows is a deep dive into who may be responsible for recruiting new members to help spread the contagion.
Click to expand...

guest · Jul 15, 2019

Is ‘REvil’ the New GandCrab Ransomware?
July 15, 2019
https://krebsonsecurity.com/2019/07/is-revil-the-new-gandcrab-ransomware/

The cybercriminals behind the GandCrab ransomware-as-a-service (RaaS) offering recently announced they were closing up shop and retiring [...] But a growing body of evidence suggests the GandCrab team have instead quietly regrouped behind a more exclusive and advanced ransomware program known variously as “REvil,” “Sodin,” and “Sodinokibi.”
There are also similarities between the ways that both GandCrab and REvil generate URLs that are used as part of the infection process, according a recent report from Dutch security firm Tesorion.

My guess is the GandCrab team has not retired, and has simply regrouped and re-branded due to the significant amount of attention from security researchers and law enforcement investigators. It seems highly unlikely that such a successful group of cybercriminals would just walk away from such an insanely profitable enterprise.
Click to expand...

guest · Aug 19, 2019

Post GandCrab, Cybercriminals Scouring the Dark Web for the Next Top Ransomware
August 19, 2019
https://threatpost.com/post-gandcra...-dark-web-for-the-next-top-ransomware/147476/

Behind the scenes, cybercriminals aren’t having as easy of a time selecting tools as it may seem. According to new research, after the notorious GandCrab ransomware gang shuttered operations in June, many have been left adrift.

“Effectively we’ve reached a point in which there’s a general interest in ransomware that’s very large in underground forums, but criminals in this case still don’t know where to look, and especially since GandCrab has retired… there’s not really a vendor that has reached that level of popularity yet,” Winnona DeSombre with Recorded Future told Threatpost in a video interview.
“Given how popular [GandCrab] was, I imagine that there will be multiple vendors trying to emerge that will compete in a similar manner.”
Click to expand...

guest · Sep 24, 2019

mood said: ↑

Is ‘REvil’ the New GandCrab Ransomware?
July 15, 2019
https://krebsonsecurity.com/2019/07/is-revil-the-new-gandcrab-ransomware/
Click to expand...

Ransomware: New file-encrypting attack has links to GandCrab malware, say security researchers
Analysis of the REvil code reveals strong links to GandCrab
September 24, 2019
https://www.zdnet.com/article/ranso...to-gandcrab-malware-say-security-researchers/

A new form of ransomware shares a number of links with the GandCrab malware according to security company researchers, even though the developers of that infamous piece of ransomware earlier this year claimed to have retired.
REvil – also known as Sodinokibi – first emerged shortly before GandCrab ceased operation and has gone onto become one of the most prominent families of ransomware of 2019.

Now security researchers in the Secureworks Counter Threat Unit have detailed what they believe to be links which demonstrate that the developers of GandCrab – who they refer to as Gold Garden – are also responsible for REvil, which could have started life as a new version of GandCrab.

"It certainly shares some code overlap with GandCrab and there are even artefacts in there which suggest that it was intended to be an evolution of GandCrab and they decided that GandCrab was ripe for a reband and relaunch," Rafe Pilling, information security researcher at Secureworks told ZDNet.
Click to expand...

Secureworks: REvil/Sodinokibi Ransomware

guest · Oct 2, 2019

mood said: ↑

Analysis of the REvil code reveals strong links to GandCrab
Click to expand...

Sodinokibi Ransomware Builds An All-Star Team of Affiliates
October 2, 2019
https://www.bleepingcomputer.com/ne...omware-builds-an-all-star-team-of-affiliates/

The Sodinokibi Ransomware (REvil) has been making news lately as they target the enterprise, MSPs, and government entities through their hand-picked team of all-star affiliates. These affiliates appear to have had a prior history with the GandCrab RaaS and use similar distribution methods.
It should be noted that we will refer to this ransomware infection as Sodinokibi as that is what it is most commonly known as to the general public and victims. This ransomware also goes under the name REvil, which is the actual name given by the malware developers.

In new research by McAfee's John Fokker, Head of Cyber Investigations, and Christiaan Beek, lead scientist & sr. principal engineer, we take a deep dive in how the GandCrab RaaS operated and some of its more high profile affiliates.
By analyzing hundreds of samples of GandCrab, the researchers told BleepingComputer that there were approximately 292 affiliates registered with the RaaS, with not all of them necessarily being active.

BleepingComputer believes that GandCrab informed their top affiliates that they would soon be shutting down and either transferred them to Sodinokibi or the affiliates just decided to move to the new RaaS.
Click to expand...

Similarities in code
In addition to the many similarities between the affiliates of Sodinokibi and GandCrab, there are also similarities within the code itself.
Last week we reported that researchers at SecureWorks identified shared code between the two ransomware and McAfee has come to the same conclusion.

According to the McAfee Advanced Threat Research, when comparing an unpacked Sodinokibi sample with GandCrab v 5.0.3, the researchers determined that there was a 40% code overlap between the two infections. Most of this similar code appears to be within the functions as shown below.
Click to expand...

McAfee: McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service – The All-Stars

guest · Oct 2, 2019

mood said: ↑

Sodinokibi Ransomware Builds An All-Star Team of Affiliates
October 2, 2019
https://www.bleepingcomputer.com/ne...omware-builds-an-all-star-team-of-affiliates/
McAfee: McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service – The All-Stars
Click to expand...

McAfee: McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service – What The Code Tells Us

Episode 1: What the Code Tells Us
McAfee’s Advanced Threat Research team (ATR) observed a new ransomware family in the wild, dubbed Sodinokibi (or REvil), at the end of April 2019. Around this same time, the GandCrab ransomware crew announced they would shut down their operations. Coincidence? Or is there more to the story?
In this series of blogs, we share fresh analysis of Sodinokibi and its connections to GandCrab, with new insights gleaned exclusively from McAfee ATR’s in-depth and extensive research.
• Episode 1: What the Code Tells Us
• Episode 2: The All-Stars
• Episode 3: Follow the Money
• Episode 4: Crescendo
In this first instalment we share our extensive malware and post-infection analysis and visualize exactly how big the Sodinokibi campaign is.
Click to expand...

guest · Oct 16, 2019

Sodinokibi Ransomware: Following the Affiliate Money Trail
October 14, 2019
https://www.bleepingcomputer.com/ne...nsomware-following-the-affiliate-money-trail/

After a Sodinokibi ransomware affiliate posted partial transaction IDs for ransomware payments, researchers were able to use that information to follow the money trail for affiliates and in some cases, how they spend their illicit earnings.

Earlier this month, McAfee provided a look at the GandCrab Ransomware-as-an-Affiliate operation and how the Sodinokibi Ransomware recruited the top performers to build an all-star team of affiliates after GandCrab was shut down.
As part of this reporting, it was shown how an affiliate named Lalartu was vouching for the Sodinokibi Ransomware RaaS on an underground malware and hacker forum.

In a new report, researchers at McAfee continue their analysis of the Sodinokibi Ransomware by following affiliate's trail of money based on transaction IDs posted by the above affiliate.
Following the money trail
While researching the Sodinokibi Ransomware affiliate, McAfee found another forum post from the affiliate named Lalartu who previously had vouched for the RaaS.
Click to expand...

Bitcoin transactions are clearly becoming less anonymous
While Bitcoin was created to be a decentralized method to send payments and to provide buyers and sellers a greater degree of privacy, with new services such as Chainalysis and others, the privacy is slowly fading away.
Click to expand...

McAfee: McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service – Follow The Money

guest · Oct 21, 2019

Tools and Tactics of the Sodinokibi Ransomware Distributors
October 21, 2019
https://www.bleepingcomputer.com/ne...cs-of-the-sodinokibi-ransomware-distributors/

Using a network of honeypots, researchers from McAfee examined the tools and tactics used by the Sodinokibi Ransomware (REvil) affiliates to infect their victims with ransomware and compromise other machines on the network.
Monitoring the attackers
In a new report shared with BleepingComputer before publication, the McAfee Advanced Threat Research team used a global network of Remote Desktop Protocol (RDP) honeypots was used to track the activities of three Sodinokibi affiliate groups.
To attempt to spread laterally throughout the network, all of the affiliates used mass port scanning tools to find accessible RDP servers and then used the NLBrute RDP brute forcing tool with custom password lists to try and gain access to servers.

Affiliate #19 appears to be the most skillful, or thorough, as McAfee saw them attempt to utilize local exploits to gain administrative access on a compromised computer. By gaining access to an administrative account, the affiliate could more easily push out and execute the ransomware on other machines on the Windows domain.
Everything search engine deployed to index documents
An interesting program that was deployed by affiliate #34 is the Everything file indexing software.
Click to expand...

Mcafee: McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service – Crescendo

guest · Nov 1, 2019

GandCrab RaaS Was a Training Ground for Malware Distributors
November 1, 2019
https://www.bleepingcomputer.com/ne...s-a-training-ground-for-malware-distributors/

GandCrab operators changed the ransomware business from the ground up, establishing a model that is embraced and continued by other cybercriminals.

Instead of keeping the operation private, limited to a small circle of experienced cybercriminals, they opened the doors to newcomers, advertised, built a relationship with customers and affiliates, and communicated with victims and researchers to stay on top of the game.
Shaping a new breed of cybercriminals
For many GandCrab partners, this was the first experience with ransomware and some grew to develop their own business. By following the same principles, some threat actors have reached new levels of financial success.
[...]
These operations and the quick rise of the group are clearly the result of GandCrab's influence. It's not just the business model that matters in achieving success; social interaction with fellow cybercriminals, potential employees and partners are also part of the game.
Click to expand...

guest · Nov 25, 2019

VB2019 paper: Different ways to cook a crab: GandCrab ransomware-as-a-service (RaaS) analysed in depth
November 2019
https://www.virusbulletin.com/virus...rab-ransomware-service-raas-analysed-indepth/

This paper examines the GandCrab ransomware, the biggest Ransomware-as-a-Service (RaaS) threat seen in 2018 and the first half of 2019. Through technical analysis, we discovered several mistakes and indicators in the malware. Armed with these findings, we were able to exploit those mistakes and build a publicly available vaccine against GandCrab.

The hard-coded indicators gave us a method to link individual ransomware samples to affiliates and, by looking at hundreds of GandCrab samples at once, we gained even more interesting insights into the service model dynamics. Subsequently, to learn more about the actor behind GandCrab and its affiliates, we carried out extensive underground forum research. This multi-angled approach gave us different ways to cook a GandCrab.
Click to expand...

Download (PDF - 6.27 MB): https://www.virusbulletin.com/uploads/pdf/magazine/2019/VB2019-Fokker-Mundo.pdf

guest · Jan 20, 2020

New paper: Behind the scenes of GandCrab's operation
January 20, 2020
https://www.virusbulletin.com/blog/2020/01/new-paper-behind-scenes-gandcrabs-operation/

Though active for only a little over a year, GandCrab was one of the most successful ransomware operations and caused a great deal of damage worldwide. Running as a Ransomware-as-a-Service scheme, the malware regularly updated itself to newer versions to stay ahead of decryptors released by security researchers, and regularly included taunts, jokes and references to security organizations and researchers in its code.

One security vendor that found itself firmly in GandCrab's firing line was South Korea-based AhnLab: GandCrab specifically targeted the company and its anti-malware program V3 Lite, even revealing a vulnerability in the security program and making attempts to delete it entirely.

In a new paper (published today in both HTML and PDF format), the AhnLab Security Analysis Team reveal the full details of the battle that went on between GandCrab and AhnLab.
Click to expand...

Log in or Sign up

GandCrab ransomware operation says it's shutting down

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

GandCrab ransomware operation says it's shutting down

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches