APT / THREAT GROUP

GandCrab

1
aliases

Intelligence Profile

A new ransomware called GandCrab was released towards the end of last week that is currently being distributed via exploit kits. GandCrab has some interesting features not seen before in a ransomware, such as being the first to accept the DASH currency and the first to utilize the Namecoin powered .BIT tld.

Threat Analysis

GandCrab is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

Intelligence Reports Mentioning GandCrab

German Police Unmask REvil Ransomware Leader
SecurityWeek· Apr 7, 2026
German authorities identify REvil and GandCrab ransomware bosses
BleepingComputer· Apr 6, 2026
Germany Doxes “UNKN,” Head of RU Ransomware Gangs REvil, GandCrab
Krebs on Security· Apr 5, 2026

External References

→https://www.bleepingcomputer.com/news/security/gandcrab-ransomware-distributed-by-exploit-kits-appends-gdcb-extension/
→https://www.bleepingcomputer.com/news/security/gandcrab-ransomware-being-distributed-via-malspam-disguised-as-receipts/
→https://www.bleepingcomputer.com/news/security/gandcrab-ransomware-version-2-released-with-new-crab-extension-and-other-changes/
→https://www.bleepingcomputer.com/news/security/gandcrab-version-3-released-with-autorun-feature-and-desktop-background/
→https://www.bleepingcomputer.com/news/security/new-fallout-exploit-kit-drops-gandcrab-ransomware-or-redirects-to-pups/
→https://www.bleepingcomputer.com/news/security/gandcrab-v5-ransomware-utilizing-the-alpc-task-scheduler-exploit/
→https://id-ransomware.blogspot.com/2018/01/gandcrab-ransomware.html
→https://www.ransomlook.io/group/gandcrab
→https://www.bleepingcomputer.com/news/security/gandcrab-ransomware-shuts-down-after-claiming-to-have-made-over-2-billion/
→https://www.trendmicro.com/en_us/research/19/f/uncovering-the-evolution-of-gandcrab-ransomware.html

Quick Facts

TypeAPT / Threat Group
Aliases1

Also Known As

GandCrab

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
← All Threat Actors·Geopolitics Map·Search GandCrab