{
  "family": "gandcrab",
  "sample_count": 2992,
  "category": "ransomware",
  "description": "GandCrab is ransomware that encrypts a victim's files and demands ransom for their return, targeting Windows PCs of both consumers and businesses. Per Malwarebytes, it launched in January 2018 and operated as a ransomware-as-a-service, with affiliates spreading it for a share of the profits. On May 31, 2019 its operators publicly announced they were shutting down. Free decryptors for certain versions were later released through industry and law-enforcement collaboration.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "GandCrab"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is GandCrab?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Ransomware that encrypts files on Windows PCs and demands payment; it targeted both consumers and businesses."
      }
    },
    {
      "@type": "Question",
      "name": "When was GandCrab active?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It launched in January 2018 and its operators announced a shutdown on May 31, 2019."
      }
    },
    {
      "@type": "Question",
      "name": "How was GandCrab distributed?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "As a ransomware-as-a-service: affiliates spread it through methods like exploit kits, phishing, and other vectors in exchange for a cut of the ransoms."
      }
    },
    {
      "@type": "Question",
      "name": "Is there a free GandCrab decryptor?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Free decryptors for certain GandCrab versions were released through industry and law-enforcement collaboration; availability depends on the version."
      }
    },
    {
      "@type": "Question",
      "name": "Should I pay the GandCrab ransom?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security guidance generally discourages paying. Check whether a free decryptor exists for your version (e.g., via the No More Ransom project) and restore from clean backups where possible."
      }
    },
    {
      "@type": "Question",
      "name": "How can I protect against ransomware like GandCrab?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Keep software patched, be cautious with email attachments and links, use reputable security software, and maintain tested offline backups."
      }
    },
    {
      "@type": "Question",
      "name": "Where can I read an authoritative source on GandCrab?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Malwarebytes maintains a GandCrab overview, linked on this page."
      }
    }
  ],
  "faq_count": 7,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1082",
    "T1083",
    "T1071.001",
    "T1566.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "sources": [
    {
      "name": "Malwarebytes: GandCrab ransomware",
      "url": "https://www.malwarebytes.com/gandcrab"
    }
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}