What is GandCrab Ransomware?

GandCrab Ransomware

malware OpenTrojan Threat Intelligence Updated 2026-08-26

Consumers and SMBs; large-scale high-volume spam RaaS

Source Attribution

Origin: MITRE
Source: FBI reward announcement · MITRE ATT&CK
Reviewer: Phase 44E review
Verified: 2026-08-26T15:16:26.825Z
Confidence: high

Source: FBI reward announcement · MITRE ATT&CK · Verified: 2026-08-26T15:16:26.825Z · Confidence: high

Security Timeline

2018-01 discovered GandCrab first observed
2019-06 updated Operators announced retirement

Quick Answer

GandCrab often requires no specific CVE: it is delivered through exploit kits and malicious spam, encrypting files with the .GDCB extension.

Definition

GandCrab was one of the highest-volume ransomware-as-a-service families of 2018-2019, distributed via exploit kits and spam, retiring in 2019 after claiming 1.5M victims.

Overview

GandCrab was one of the highest-volume ransomware-as-a-service families of 2018-2019, distributed via exploit kits and spam, retiring in 2019 after claiming 1.5M victims.

Behavior

High-volume RaaS distribution
1.5M victims claimed
Retirement announced June 2019

First Seen

2018-01

Target

Consumers and SMBs; large-scale high-volume spam RaaS

Techniques: T1486, T1566
Campaigns: n/a
Related CVEs: n/a

Malware Intelligence

Family: GandCrab Ransomware

Aliases: GandCrab

Techniques: T1486, T1566

Targets: Consumers and SMBs; large-scale high-volume spam RaaS

Behavior:

High-volume RaaS distribution
1.5M victims claimed
Retirement announced June 2019

References

Have a follow-up question?

Ask OpenTrojan's evidence-backed assistant about this topic — answers cite their sources.

Ask AI about this Start an investigation

Start Investigation

Move from reading to investigating GandCrab Ransomware. The workspace is a structured analysis surface — not a chat — organised as:

Question — what do you need to know about GandCrab Ransomware?

Evidence — assertions mapped to verifiable references.

Timeline — events in chronological order.

Related Entities — CVE, threat actor, campaign, malware links.

Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.

Notes — your own observations and working hypotheses.

AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.