October 19, 2018 By Douglas Bonderud 2 min read

GandCrab ransomware has evolved again, and the newest version features a partnership with NTCrypt to facilitate code obfuscation and frustrate security researchers.

As noted by McAfee, GandCrab’s authors deployed version 5 of the ransomware on Sept. 27. Since first appearing in January 2018, the code’s authors have released regular updates that both improved functionality and introduced new bugs.

As the McAfee report put it, the ransomware authors “are undoubtedly confident and have strong marketing skills, but flawless programming is not one of their strengths.” Still, public endorsement of FalloutEK and a new partnership with NTCrypt suggest that GandCrab is looking to claw its way into as many devices as possible with this new iteration.

What Does GandCrab’s Development Mean for Malware Security?

The makers of GandCrab aren’t afraid of notoriety; each new release comes with flashy announcements and promises of new partnerships. As a result, a members-only club of affiliates has developed around GandCrab, with more waiting in the wings to distribute the ransomware. GandCrab’s popularity has also led to partnerships with other criminal groups, which has helped the malware evolve from a simple infection vector to a more sophisticated ransomware-as-a-service.

Particularly concerning is GandCrab’s ability to attract other criminal groups. Its partnership with NTCrypt was established by way of competition: The crypter received $500 from the developers and free advertising in all of GandCrab advertisements. Beyond the obfuscation offered by NTCrypt services, this recruiting method provides a way for malware developers to avoid low-quality partners while diversifying their supply chain.

The ransomware uses multiple attack vectors to infect devices, encrypt files and demand cryptocurrency, including remote desktop connections, phishing emails, legitimate programs with hidden Trojans, exploit kits, PowerShell scripts and botnets such as Phorpiex.

How to Avoid the Pinch of GandCrab’s Code Obfuscation

Although the GandCrab developers are working hard to deliver regular updates, their lack of coding sophistication also introduces bugs that limit functionality or cause outright failure. For example, a compiling flaw in version 5 relies on a dynamic-link library (DLL) not available in Windows Vista or XP, meaning the malware will only work on machines running Windows 7 or later. The authors also claimed that their code doesn’t rely on existing CVE’s, but this is inaccurate — GandCrab uses both CVE-2018-8440 and CVE-2018-8120.

Despite its flaws, however, GandCrab remains a potent attack vector. To counter this type of malware security threat, security experts recommend establishing a security baseline, incorporating security best practices into all endpoint builds and ensuring a consistent “golden image” that adheres to your security policy. Security teams should also create and maintain a live inventory of all devices to help pinpoint malware infections, and develop “an aggressive and current patch management policy” to help mitigate the impact of existing vulnerabilities.

Source: McAfee

More from

3 Strategies to overcome data security challenges in 2024

3 min read - There are over 17 billion internet-connected devices in the world — and experts expect that number will surge to almost 30 billion by 2030.This rapidly growing digital ecosystem makes it increasingly challenging to protect people’s privacy. Attackers only need to be right once to seize databases of personally identifiable information (PII), including payment card information, addresses, phone numbers and Social Security numbers.In addition to the ever-present cybersecurity threats, data security teams must consider the growing list of data compliance laws…

ICS CERT predictions for 2024: What you need to know

4 min read - As we work through the first quarter of 2024, various sectors are continuously adapting to increasingly complex cybersecurity threats. Sectors like healthcare, finance, energy and transportation are all regularly widening their digital infrastructure, resulting in larger attack surfaces and greater risk exposure.Kaspersky just released their ICS CERT Predictions for this year, outlining the key cybersecurity challenges industrial enterprises will face in the year ahead. The forecasts emphasize the persistent nature of ransomware threats, the increasing prevalence of cosmopolitical hacktivism, insights…

Can memory-safe programming languages kill 70% of security bugs?

3 min read - The Office of the National Cyber Director (ONCD) recently released a new report, “Back to the Building Blocks: A Path Toward Secure and Measurable Software." The report is one of the first major announcements from new ONCD director Harry Coker and makes a strong case for adopting memory-safe programming languages. This new focus stems from the goal of rebalancing the responsibility of cybersecurity and realigning incentives in favor of long-term cybersecurity investments. Memory-safe programming languages were also included as a…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today