GandcrabMalware
- grandcrab
GandCrab was a Ransomware-as-a-Service (RaaS) emerged in January 28, 2018, managed by a criminal organization known to be confident and vocal, while running a rapidly evolving ransomware campaign. Through their aggressive, albeit unusual, marketing strategies and constant recruitment of affiliates, they were able to globally distribute a high volume of their malware.From MISP Galaxy
Last reported 3 years ago, by Huntress3 reports
ATT&CK techniques
4 techniques · each with the sentence it comes from- T1055Process Injection
“We analyzed the alerts that were generated after an adversary’s process injection attempts were prevented by Elastic Endpoint Security on several endpoints.”
- T1195Supply Chain Compromise
“…ts the connections to their environment from their MSP via the remote desktop support application, which introduces the risk of supply chain compromise.”
- T1199Trusted Relationship
“In this post, we discussed a real-world case of a malicious actor abusing trusted relationships between an MSP and its customers and attempting to deploy ransomware.”
- T1219.002Remote Desktop Software
“In this case, reviewing the processes and their command line arguments revealed that the adversary leveraged ScreenConnect remote desktop software to connect and copy a batch file to the target endpoint.”
What the reports say
3 reports, newest first · the exact sentence from each-
Using Shodan Images to Hunt Down Ransomware Groups“GandCrab—also known as REvil—has rebranded many times and has had many of its affiliates arrested worldwide:”
-
Ransomware, interrupted: Sodinokibi and the supply chain“The following specific toolmarks and behaviors indicate that this activity is consistent with the execution of the Sodinokibi or Gandcrab ransomware specimens as reported by BleepingComputer and Cynet:”
-
CVE-2017-18362: SQL Injection in ManagedITSync Integration“…ck Managed Service Providers and their customers by tasking all managed endpoints to download and execute a ransomware variant known as GandCrab.”
Indicators in its reports
named in the reports above- hxxps://lolbas-project.github[.]io/in 1 report
- lolbas-project.github[.]ioin 1 report
- hxxps://www.europol.europa[.]eu/media-press/newsroom/news/five-affiliates-to-sodinokibi/revil-unpluggedin 1 report
- vncport.hacked[.]comin 1 report
- hxxps://mykaseyaserver[.]com/kaseyacwwebservice/managedit.asmxin 1 report
- mykaseyaserver[.]comin 1 report
- hxxps://pastebin[.]com/raw/in 1 report
Copy these 7 indicators · defanged
Thanks — we review every report.