GandCrab Makers Claimed Two Billion
In this post
Imagine a shopkeeper at the end of a long season, writing a goodbye note and taping it to the door. He thanks nobody. He apologises for nothing. Instead, he brags — loudly — about how much money he made, and how he now plans to retire in comfort.
That is more or less what happened in May 2019, except the shop was not selling clothes or shoes. It was selling a weapon. The farewell note came from the criminal gang behind GandCrab, one of the most widespread ransomware programs the world has ever seen, and in that note the gang claimed it had earned and washed more than two billion dollars.
Two billion. It is a number big enough to buy a small island. But before you believe it, hold on to one important detail: that figure was the gang’s own boast, posted by the gang itself, and it was never independently verified. Criminals brag the way fishermen brag — the fish always grows in the telling.
Behind them, though, a very different scene was unfolding. While the gang was writing its proud goodbye, police officers and security experts were quietly doing something the note forgot to mention: handing out free keys to victims, so thousands of people could unlock their files without paying a single coin.
To understand the goodbye letter, you first have to understand the strange shop that GandCrab really was.
What GandCrab ransomware actually did
Ransomware is a kind of harmful software — malware — that locks your files. Your photos, your documents, your work, even the records of a whole business: all of it is scrambled with strong encryption, turned into unreadable nonsense. Then a note appears, demanding money. Pay, the criminals say, and we will give you the key. Say no, and the lock stays on, perhaps for good.
GandCrab was a ransomware family that appeared in January 2018. Within just a few months, it had spread so widely that it became one of the most common ransomware threats on the planet. Security firms later estimated that its victims numbered in the millions.
But one feature made GandCrab different from the lone-wolf viruses of the past, and it made the family grow so fast: its creators were not the ones breaking into computers.
They were landlords.
GandCrab’s rental shop: ransomware as a service
Picture a market stall that does not sell stolen goods but rents out burglar tools. Anyone can walk up, rent the tools for a cut of whatever they steal, and go rob houses all over town while the stall owner sits safely at home collecting his share.
That was GandCrab’s business model, and it has a name: ransomware as a service.
The creators built the ransomware, kept improving it, and rented it out to other criminals, called affiliates. The affiliates did the dirty work — sending the poisoned emails, breaking into the websites, choosing the victims. When a victim paid a ransom, the money was split, with a reported share flowing back to the GandCrab creators.
This model explains GandCrab’s speed. One small team did not have to attack the whole world. It only had to build a good lock-picking kit and find many hands willing to hold it. Dozens of criminals could attack at once, in different countries, while the creators stayed in the shadows, updating their product like a software company.
And they did update it — constantly. GandCrab went through version after version in a running arms race with antivirus companies. Every time the defenders learned to spot one version, a fresh one appeared with changes designed to slip past. In its later versions, GandCrab could also move sideways inside office networks, spreading from one computer to others in the same building, so a single infection at a company could end with the whole office locked.
How GandCrab reaches an ordinary person
You might think ransomware only hunts big companies with big bank accounts. GandCrab’s story shows the opposite. Because it was rented out by so many different criminals, it went everywhere — including the home laptop of an ordinary person who never did anything dangerous.
The brief names three main roads it travelled:
Spam emails. A message arrives that looks routine — a bill, a delivery note, a document someone seems to be sharing. Inside is an attachment or a link carrying the ransomware. Open it, and the locking begins quietly in the background.
Hacked websites. Sometimes the trap was not in your inbox but on a page you visited. Criminals broke into normal websites and hid attack code on them, so a regular visit to a regular site could become the moment of infection.
Exploit kits. These are the booby traps of the internet. An exploit kit is a hidden bundle of attacks placed on a web page. When your browser visits the page, the kit silently tests your computer for weak spots — an out-of-date browser, an old plugin — and if it finds one, it uses that hole to install the malware. No click, no warning, no chance to say no.
Notice something about all three roads: none of them needs you to be careless in some dramatic way. You do not have to visit a dark corner of the internet. An ordinary email, an ordinary website, an ordinary afternoon — that was enough. That is what made GandCrab frightening.
The damage GandCrab left behind
When ransomware locks a computer, the harm is never just “files are scrambled.” Think about what those files mean. A family loses years of photographs. A small shop loses its accounts and customer lists the week before its busiest season. A clinic, a school, a local office — each locked screen is real work stopped, real income delayed, real people stressed and frightened.
Multiply that single locked screen by the millions of victims security firms estimated, and you begin to see the true size of the damage. Some victims paid, hoping the key would work. Some rebuilt everything from nothing. Many faced the worst choice of all: pay criminals and maybe get the files back, or refuse and lose them completely.
Then, in May 2019, came the farewell note. The operators announced they were shutting down, and claimed they had earned and laundered more than two billion dollars before retiring rich. Again — that number is the gang’s own claim, published by the gang, and nobody independent ever confirmed it. It may have been a boast meant to impress the criminal world rather than a fact.
But here is the part of the story I find hardest to forget: while one side was writing a victory speech, the other side had already been winning quietly for months.
The quiet counter-attack: free keys from No More Ransom
There is a project called No More Ransom, a partnership between police forces and security companies. Its idea is simple: when researchers find a way to undo a ransomware’s lock — because the gang made a mistake, because police seized its servers and found keys, because the code had a weakness — the project gives the unlocking tool to victims for free.
GandCrab was one of its success stories. Free decryption tools for GandCrab were released through No More Ransom, at times built with keys that reached the defenders through police work. These tools were reported to have helped many thousands of victims unlock their files without paying anything.
Think about what that means. Somewhere, a person sat before a locked computer, reading a demand for money they could not afford — then found a free tool, ran it, and watched their photographs and documents come back. The gang’s farewell letter never mentions those people. They are the real ending of the GandCrab story.
How to protect yourself from GandCrab-style attacks
You cannot control criminal gangs, but you can make their job much harder. These steps are simple, and every one of them directly blocks the roads GandCrab used.
Keep offline backups. Copy your important files to an external drive that is not always connected to your computer. Ransomware can only lock what it can reach. If a clean copy exists on a drive sitting in a drawer, a locked computer becomes an inconvenience, not a disaster. Test your backup once in a while to make sure it actually works.
Update your browser and software. Exploit kits live on weak spots, and most weak spots are old versions that already have a fix waiting. When your browser, your system, or your apps offer an update, install it. An updated computer closes the very holes GandCrab’s traps were built to find.
Treat email attachments with suspicion. A message asking you to open a document quickly, pay a bill urgently, or check a delivery you never ordered is the classic ransomware road. Slow down. If the message claims to be from a company or a person you know, check through a separate channel before opening anything.
Keep security protection switched on. A good, updated antivirus or built-in security tool cannot catch everything, but GandCrab’s versions fought antivirus companies for a reason — the protection genuinely got in their way.
If the worst happens, check No More Ransom before anything else. This is the lesson GandCrab teaches best: never pay first. Gangs lose keys. Gangs get raided. Researchers beat their code. Before even thinking about paying, visit the No More Ransom website and check whether a free decryption tool already exists for the ransomware that locked you. In the GandCrab case, many thousands of people got their files back for free simply because they checked.
Common questions
What is GandCrab in simple words?
GandCrab was a ransomware program — software that secretly scrambles your files and demands money to unscramble them. It appeared in January 2018 and spread so fast that within months it was one of the most widespread ransomware threats in the world.
Did the GandCrab gang really make two billion dollars?
Nobody knows, and that is the honest answer. In their May 2019 farewell announcement, the operators claimed they had earned and laundered more than two billion dollars. That figure came from the gang itself and was never independently verified, so treat it as a boast, not a fact.
What does “ransomware as a service” mean?
It means the creators did not attack victims directly. They built the ransomware and rented it to other criminals, who carried out the attacks and paid the creators a reported share of each ransom collected. The model let one small team power attacks all over the world at the same time.
How did GandCrab get onto people’s computers?
It spread mainly through spam emails carrying poisoned attachments or links, through hacked websites hiding attack code, and through exploit kits — booby-trapped pages that silently attack out-of-date browsers and plugins. Later versions could also spread within office networks once a single computer was infected.
If ransomware locks my files, should I pay?
Check for a free solution first. The No More Ransom project, run by police and security companies, offers free decryption tools for many ransomware families, including tools that helped many thousands of GandCrab victims. Paying is never a guarantee — a free key might already exist for your lock.
Sources
- Wikipedia — Ransomware as a service (GandCrab section): https://en.wikipedia.org/wiki/Ransomware_as_a_service
- No More Ransom project: https://www.nomoreransom.org
