Threat actor
threat_actor:gandcrab
Also: GandCrab group
Criminal group associated with operating GandCrab and pioneering big-game ransomware attacks.
Criminal group associated with operating GandCrab and pioneering big-game ransomware attacks.
“GandCrab was both the name of the ransomware and the group who were running it”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | USES | big game hunting | Explicit | 126 |
| outgoing | USES | ransomware as a service | Explicit | 126 |
| outgoing | USES | OSINT | Explicit | 126 |
| outgoing | USES | initial access broker | Explicit | 126 |
GandCrab USES big game hunting
Will says the GandCrab group pioneered big game hunting, meaning attacks focused on large, wealthy companies.
Explicit Confidence 96% · Will EP 126 Details
“GandCrab is – it was basically the group that pioneered what we call big game hunting.”
GandCrab USES ransomware as a service
GandCrab evolved from ransomware into a ransomware-as-a-service operation for customers and affiliates.
Explicit Confidence 98% · Jack Rhysider EP 126 Details
“GandCrab wasn’t just ransomware, but it evolved into ransomware as a service.”
GandCrab used open-source information about companies’ profits and turnover to select lucrative targets.
Explicit Confidence 98% · Jack Rhysider EP 126 Details
“to figure that out, GandCrab did some OSINT.”
GandCrab USES initial access broker
GandCrab obtained access to companies through the underground initial-access market.
Explicit Direction flagged Confidence 95% · Jack Rhysider EP 126 Details
“this is how the GandCrab group would infect companies; they’d buy access into a company”