www.itfunk.orgwww.itfunk.orgwww.itfunk.org
  • Home
  • Tech News
    Tech NewsShow More
    Under the Hood of Microsoft’s May 2025 Patch Tuesday: The CLFS and WinSock Problem Microsoft Can’t Seem to Fix
    7 Min Read
    The Hidden Sabotage: How Malicious Go Modules Quietly Crashed Linux Systems
    6 Min Read
    Agentic AI: The Next Frontier in Cybersecurity Defense and Risk​
    5 Min Read
    Cybersecurity CEO Arrested for Allegedly Installing Malware on Hospital Computers: A Stark Reminder of Insider Threats
    8 Min Read
    Cybercriminals Hijack Google’s Reputation
    7 Min Read
  • Cyber Threats
    • Malware
    • Ransomware
    • Trojans
    • Adware
    • Browser Hijackers
    • Mac Malware
    • Android Threats
    • iPhone Threats
    • Potentially Unwanted Programs (PUPs)
    • Online Scams
  • How To Guides
    How To GuidesShow More
    Tasksche.exe Malware
    Nviqri Someq Utils Unwanted Application
    4 Min Read
    How to Deal With Rbx.fund Scam
    4 Min Read
    How to Jailbreak DeepSeek: Unlocking AI Without Restrictions
    4 Min Read
    Why Streaming Services Geo-Restrict Content?
    10 Min Read
  • Product Reviews
    • Hardware
    • Software
  • IT/Cybersecurity Best Practices
    IT/Cybersecurity Best PracticesShow More
    Under the Hood of Microsoft’s May 2025 Patch Tuesday: The CLFS and WinSock Problem Microsoft Can’t Seem to Fix
    7 Min Read
    Affordable Endpoint Protection Platforms (EPP) for Small Businesses
    5 Min Read
    Outlaw Malware: A Persistent Threat Exploiting Linux Servers
    4 Min Read
    CVE-2024-48248: Critical NAKIVO Backup & Replication Flaw Actively Exploited—Patch Immediately
    6 Min Read
    How to Jailbreak DeepSeek: Unlocking AI Without Restrictions
    4 Min Read
  • FREE SCAN
  • Cybersecurity for Business
Search
  • ABOUT US
  • TERMS AND SERVICES
  • SITEMAP
  • CONTACT US
© 2023 ITFunk.org. All Rights Reserved.
Reading: Past Infections like GandCrab and More Recent REvil/Sodinokibi Ransomware Are a Dangerous Threat
Share
Notification Show More
Font ResizerAa
www.itfunk.orgwww.itfunk.org
Font ResizerAa
  • Tech News
  • How To Guides
  • Cyber Threats
  • Product Reviews
  • Cybersecurity for Business
  • Free Scan
Search
  • Home
  • Tech News
  • Cyber Threats
    • Malware
    • Ransomware
    • Trojans
    • Adware
    • Browser Hijackers
    • Mac Malware
    • Android Threats
    • iPhone Threats
    • Potentially Unwanted Programs (PUPs)
    • Online Scams
  • How To Guides
  • Product Reviews
    • Hardware
    • Software
  • IT/Cybersecurity Best Practices
  • Cybersecurity for Business
  • FREE SCAN
Follow US
  • ABOUT US
  • TERMS AND SERVICES
  • SITEMAP
  • CONTACT US
© 2023 ITFunk.org All Rights Reserved.
www.itfunk.org > Blog > Cyber Threats > Ransomware > Past Infections like GandCrab and More Recent REvil/Sodinokibi Ransomware Are a Dangerous Threat
Ransomware

Past Infections like GandCrab and More Recent REvil/Sodinokibi Ransomware Are a Dangerous Threat

ITFunk Research
Last updated: October 24, 2023 4:21 pm
ITFunk Research
Share
Past Infections like GandCrab and More Recent REvil/Sodinokibi Ransomware Are a Dangerous Threat
SHARE

Brief History of GandCrab Criminal Case

In August of 2020, a distributor of the infamous GandCrab ransomware was arrested in Belarus on charges of hacking and profiting off of more than 1,000 victims around the world.

Contents
Brief History of GandCrab Criminal CaseWhat Exactly Do We Know About GandCrab?REvil Ransomware the Heir Apparent to GandCrab Ransomware

The 31-year-old male was alleged to have distributed the malware between 2017 and 2018, demanding up to $1,500 in bitcoin to decrypt the victims’ data. It was not believed that the man in custody created the ransomware, but he was described as a distributor who rented access to an admin panel and could send off customized malware campaigns in return for a portion of any ransom payments.

This arrest came more than a year after GandCrab’s creators announced they were retiring. Since then, another dangerous ransomware strain dubbed ‘REvil’ has come to the forefront. Due to similarities in code and behavior, many experts believe there are strong links between the GandCrab and REvil ransomware developers.

What Exactly Do We Know About GandCrab?

GandCrab ransomware was first discovered in January 2018. This malware targets Microsoft Windows devices to encrypt victims’ files, and then demands payment of a ransom to recover stolen data.

According to Bitdefender, GandCrab ransomware has targeted more than 1.5 million victims worldwide, and its operators have claimed to have made over $2 billion in ransom payments. Little is known about the people behind GandCrab ransomware. However, the ransomware’s code had specific language-based rulesets that would not allow it to infect machines in Russia and former Soviet Union countries.

GandCrab uses the Ransomware-as-a-Service (RaaS) model, meaning that the authors sell access to the malware to clients, most often through a customizable admin portal, and the customers of the malware’s authors then conduct their own cybercrime campaigns.

REvil Ransomware the Heir Apparent to GandCrab Ransomware

Before the supposed shutdown of GandCrab ransomware, a ransomware named ‘REvil’ or Sodinokibi ransomware victimized high-profile targets including Travelex, a law firm representing several big-ticket celebrities and even President Donald Trump!

The Travelex attack forced the company offline and saw the attackers demand $6 million in return to restore their customers’ data, sensitive customer data like credit card information and birth dates. REvil ransomware also crippled local governments in the state of Texas in August of 2019.

Additionally, data stolen from a US IT staffing organization known as Artech Information Systems was published online in January of 2020 after the attackers claimed it failed to pay the ransom.

The shutdown announcement related to GandCrab ransomware added fuel to rumors that REvil ransomware was, in fact, being run by the same outfit, due to the two pieces of ransomware being remarkably similar. 

You Might Also Like

Desolator Ransomware (.desolated)
Dance of Hillary Malware
Tasksche.exe Malware
GovCrypt Ransomware
BackLock Ransomware (.backlock)
TAGGED:Ransomware

Sign Up For Daily Newsletter

Be keep up! Get the latest breaking news delivered straight to your inbox.
By signing up, you agree to our Terms of Use and acknowledge the data practices in our Privacy Policy. You may unsubscribe at any time.
Share This Article
Facebook Copy Link Print
Share
Previous Article Beware of the DarkSide! The Early History of the Prolific Ransomware Gang
Next Article The Russian hacking group APT29 targets Coronavirus vaccine research organizations in the UK, US, and Canada using WellMess and WellMail malware
Leave a Comment

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Think You're Infected? Let's Find Out – FAST.
SpyHunter identifies viruses, ransomware, and hidden threats in under a minute.
🛡️ Scan Your Device for Free
✅ Free Scan Available • ⭐ Catches malware instantly
//

Check in Daily for the best technology and Cybersecurity based content on the internet.

Quick Link

  • ABOUT US
  • TERMS AND SERVICES
  • SITEMAP
  • CONTACT US

Support

Sign Up for Our Newesletter

Subscribe to our newsletter to get our newest articles instantly!

 

www.itfunk.orgwww.itfunk.org
© 2023 www.itfunk.org. All Rights Reserved.
  • ABOUT US
  • TERMS AND SERVICES
  • SITEMAP
  • CONTACT US
Welcome Back!

Sign in to your account

Username or Email Address
Password

Lost your password?