GandCrab

GandCrab is a ransomware-as-a-service (RaaS) operation first advertised in early 2018. It initially spread through spam emails with malicious attachments and was a key early large-scale RaaS platform that expanded targeting toward larger companies and leveraged new attack vectors such as MSPs. Reporting in the provided content states that GandCrab later evolved into REvil, also known as Sodinokibi, in 2019, and multiple sources cited code, behavioral, and operational continuity between the two operations. The content describes GandCrab and later REvil as using an affiliate model in which operators maintained the malware and extortion infrastructure while affiliates obtained victims. GandCrab is also described as part of the development of double-extortion tradecraft later associated with REvil, including demands for payment in exchange for decryption and, in later evolution, non-publication of stolen data. German authorities identified alleged Russian nationals Daniil Maksimovich Shchukin, also known as UNKN or UNKNOWN, and Anatoly Sergeevitsch Kravchuk as key figures behind GandCrab and later REvil; BKA reporting cited in the content says Shchukin acted as head of GandCrab and later REvil from the beginning of 2019 until at least July 2021, while Kravchuk allegedly contributed to development of the ransomware and the dark web extortion platform. The content also states GandCrab publicly claimed very large illicit earnings before shutting down in 2019.