Researchers find campaigns distributing Gandcrab by hosting malware on legitimate websites with poor security measures.
Gandcrab, among the newest threats in the ransomware space, started as a simple attack and quickly evolved as its authors adapted to security defenses. In the first two months of 2018, attackers infected more than 50,000 victims and generated more than 0,000 for attackers. This threat spreads via spam campaigns and exploit kits including Rig and Grandsoft.
How One AI-Driven Media Platform Cut EBS Costs for AWS ASGs by 48%
Talos researchers were analyzing a recent spam campaign when they found a series of compromised sites delivering Gandcrab and continued to identify four separate campaigns over the period of one week. The first started on April 30 and was disguised as an online order. An attached ZIP file has a Word document that downloads and executes the ransomware. Emails contained either VBScripts or ZIP files but always delivered the same result.
Read more: Dark Reading
