{"id":25612,"date":"2018-10-25T10:11:19","date_gmt":"2018-10-25T09:11:19","guid":{"rendered":"http:\/\/www.intelligentcio.com\/eu\/?p=25612"},"modified":"2018-10-26T08:07:30","modified_gmt":"2018-10-26T07:07:30","slug":"new-decryption-tool-launched-to-support-victims-of-gandcrab-ransomware","status":"publish","type":"post","link":"https:\/\/www.intelligentcio.com\/eu\/2018\/10\/25\/new-decryption-tool-launched-to-support-victims-of-gandcrab-ransomware\/","title":{"rendered":"Decryption tool launched to support victims of GandCrab ransomware"},"content":{"rendered":"
A new tool has been developed to enable victims of the GandCrab ransomware to recover their files without giving into the demands of the criminals.<\/div>\n
<\/div>\n
A data recovery kit,\u00a0developed by the Romanian Police in collaboration with its counterparts from Bulgaria, France, Hungary, Italy, Poland, the Netherlands, United Kingdom and United States, together with the security company Bitdefender and Europol, is now available for free\u00a0on\u00a0www.nomoreransom.org.<\/div>\n
<\/div>\n
\n

It is the most comprehensive decryption tool available to date for this particular ransomware family. It works for all but two existing versions of the malware (v.1,4 and 5), regardless of the victim\u2019s geographical location.<\/p>\n

This tool is released a week after the criminal group behind GandCrab made public decryption keys allowing only a limited pool of victims located in Syria to recover their files.<\/p>\n

GandCrab in a nutshell\u00a0<\/strong><\/p>\n

GandCrab is one of the most aggressive malware attacks in recent months, infecting nearly half a million victims since it was first detected in January 2018.<\/p>\n

Once GandCrab takes over a victim\u2019s computer and encrypts its files, it demands a ransom ranging from US$300 to US$6,000. The ransom must be paid through virtual currencies known to make online transactions less traceable, such as DASH and Bitcoin.<\/p>\n

Back in February,\u00a0a first decryption tool\u00a0was made available on\u00a0No More Ransom\u00a0by the Romanian Police, with the support of the cybersecurity company Bitdefender and Europol. A second version of the GandCrab ransomware was subsequently released by the criminals, this time with an improved coding which included comments to provoke law enforcement, security companies and No More Ransom. A third version followed a day later.<\/p>\n

Now in its fifth version, this file-locking malware continues to be updated at an aggressive pace. Its developers are constantly releasing new versions of it, with new, more sophisticated samples being made available to bypass cybersecurity vendors\u2019 countermeasures.<\/p>\n

Underground alliances<\/strong><\/p>\n

The rapid spread of GandCrab has been helped along by a ransomware-as-a-service scheme, which offers on the dark web to would-be criminals with little to no technical expertise, a toolkit for launching quick and easy malware attacks, in exchange for a 30% cut from each ransom payment.<\/p>\n

In order to further maximise the profits, the GandCrab developers are also partnering up with other services in the cybercrime supply chain, enabling different criminal groups to practice their core competencies while working together to earn more illicit profits than they would be able to gather working individually.<\/p>\n

How to stay safe in the future<\/strong><\/p>\n

Victims who have fallen to this ransomware should visit\u00a0nomoreransom.org\u00a0where this new decryption tool is available for free.<\/p>\n

The best cure against ransomware remains diligent prevention. Users are strongly advised to:<\/p>\n