{"id":29278,"date":"2019-09-24T14:26:35","date_gmt":"2019-09-24T14:26:35","guid":{"rendered":"http:\/\/4dbb0676-ab55-48fe-9423-21e6366e7cc1"},"modified":"2019-09-24T14:26:35","modified_gmt":"2019-09-24T14:26:35","slug":"ransomware-new-file-encrypting-attack-has-links-to-gandcrab-malware-say-security-researchers","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/ransomware-new-file-encrypting-attack-has-links-to-gandcrab-malware-say-security-researchers\/","title":{"rendered":"Ransomware: New file-encrypting attack has links to GandCrab malware, say security researchers"},"content":{"rendered":"<div><img decoding=\"async\" src=\"https:\/\/zdnet4.cbsistatic.com\/hub\/i\/r\/2018\/10\/31\/1f2d630a-287d-4866-b28f-b44ccd319085\/thumbnail\/770x578\/8502e130878dc868b8bc81b8b1de18e5\/man-looking-sad-because-his-computer-is-infected-with-ransomware.jpg\" class=\"ff-og-image-inserted\"><\/div>\n<p>A new form of ransomware shares a number of links with the <a href=\"https:\/\/www.zdnet.com\/article\/ransomware-11-steps-you-should-take-to-protect-against-disaster\/\" target=\"_blank\" rel=\"noopener noreferrer\">GandCrab malware<\/a>&nbsp;according to security company researchers, even though the developers of that infamous piece of ransomware earlier this year <a href=\"https:\/\/www.zdnet.com\/article\/gandcrab-ransomware-operation-says-its-shutting-down\/\">claimed to have retired<\/a>.<\/p>\n<p>GandCrab was one of the most successful <a href=\"https:\/\/www.zdnet.com\/article\/ransomware-an-executive-guide-to-one-of-the-biggest-menaces-on-the-web\/\">families of ransomware<\/a> during 2018 and 2019, with its authors offering it out &#8216;as-as-service&#8217; in exchange for a cut for the profits. In June, they suddenly announced they were retiring, claiming to have earned over $2 billion since <a href=\"https:\/\/www.zdnet.com\/article\/hit-by-ransomware-this-new-free-decryption-tool-for-gandcrab-might-help\/\">GandCrab first emerged in January 2018<\/a>.<\/p>\n<p>Many were sceptical as to whether the GandCrab crew had really ceased operations and now researchers have uncovered technical links between GandCrab and another form of ransomware \u2013 REvil \u2013 which suggest that the two forms of malware have the same authors.<\/p>\n<p>REvil \u2013 also known as Sodinokibi \u2013 <a href=\"https:\/\/www.zdnet.com\/article\/sodinokibi-ransomware-is-now-using-a-former-windows-zero-day\/\">first emerged<\/a> shortly before GandCrab ceased operation and has gone onto become <a href=\"https:\/\/www.zdnet.com\/article\/at-least-20-texas-local-governments-hit-in-coordinated-ransomware-attack\/\">one of the most prominent<\/a> families of ransomware of 2019.<\/p>\n<p>Now security <a href=\"https:\/\/www.secureworks.com\/research\/revil-sodinokibi-ransomware\" target=\"_blank\" rel=\"noopener noreferrer\">researchers in the Secureworks Counter Threat Unit<\/a> have detailed what they believe to be links which demonstrate that the developers of GandCrab \u2013 who they refer to as Gold Garden \u2013 are also responsible for REvil, which could have started life as a new version of GandCrab.<\/p>\n<p><strong><strong>SEE:&nbsp;<\/strong><a href=\"http:\/\/www.zdnet.com\/topic\/a-winning-strategy-for-cybersecurity\/\"><strong>A winning strategy for cybersecurity<\/strong><\/a><strong>&nbsp;(ZDNet special report) |&nbsp;<\/strong><a href=\"https:\/\/www.techrepublic.com\/resource-library\/whitepapers\/a-winning-strategy-for-cybersecurity-free-pdf\/?ftag=CMG-01-10aaa1b\" target=\"_blank\" rel=\"noopener noreferrer\"><strong>Download the report as a PDF<\/strong><\/a><strong>&nbsp;(TechRepublic)<\/strong><\/strong><\/p>\n<p>&#8220;It certainly shares some code overlap with GandCrab and there are even artefacts in there which suggest that it was intended to be an evolution of GandCrab and they decided that GandCrab was ripe for a reband and relaunch,&#8221; Rafe Pilling, information security researcher at Secureworks told ZDNet.<\/p>\n<section class=\"sharethrough-top\" data-component=\"medusaContentRecommendation\" data-medusa-content-recommendation-options=\"{&quot;promo&quot;:&quot;promo_ZD_recommendation_sharethrough_top_in_article_desktop&quot;,&quot;spot&quot;:&quot;dfp-in-article&quot;}\">\n<\/section>\n<p>Analysis of REvil found that the string decoding functions employed by REvil and GandCrab are nearly identical, suggesting a strong link between the two forms of ransomware. REvil and GandCrab also share URL building functionality which produces the same URL patterns for command and control servers.<\/p>\n<p>&#8220;When we see things like that, it&#8217;s a tell-tale which suggests the code has been shared,&#8221; said Pilling.<\/p>\n<p>There&#8217;s also evidence that REvil was initially just intended to be a new version of GandCrab ransomware, as analysis of a beta version of REvil reveals that there are lines in the code which appear to be references to GandCrab. These include &#8216;gcfin&#8217;, which researchers believe stands for &#8216;GandCrab Final&#8217;, and &#8216;gc6&#8217; which is believed to stand for GandCrab 6.<\/p>\n<p>With those behind GandCrab famous for running a slick operation, it&#8217;s likely that these references to their original ransomware are a mistake \u2013 but it has enabled researchers to directly link REvil to the same group.<\/p>\n<p>In addition to the similarities in the code, both REvil and GandCrab whitelist certain keyboard layouts so as to not infect Russian-based hosts. While this doesn&#8217;t directly link the two operations, it does suggest they are based in the same region.<\/p>\n<p>When Gold Garden pulled GandCrab it was still running a successful operation, with a new build of the ransomware having only recently been released to counter <a href=\"https:\/\/www.zdnet.com\/article\/game-over-for-gandcrab-new-free-decryption-tool-allows-victims-to-unlock-all-versions-of-this-ransomware\/\">a free decryption tool<\/a>. However, it&#8217;s possible that the attackers introduced REvil to refresh their operations in an effort to keep one step ahead of law enforcement and security professionals.<\/p>\n<p>REvil has already become <a href=\"https:\/\/www.zdnet.com\/article\/ransomware-hits-hundreds-of-dentist-offices-in-the-us\/\">one of the most high profile forms of ransomware<\/a> and researchers warn that it&#8217;s set to replace GandCrab as the widespread ransomware threat.<\/p>\n<p>To limit the damage of ransomware attacks, it&#8217;s recommended that organisations <a href=\"https:\/\/www.techrepublic.com\/article\/how-to-select-a-data-backup-system\/?ftag=CMG-01-10aaa1b\" target=\"_blank\" rel=\"noopener noreferrer\">regularly backup their data<\/a> and to patch systems to protect against cyber attacks which spread by exploiting old vulnerabilities.<\/p>\n<p><strong>READ MORE ON CYBERCRIME<\/strong><\/p>\n<p>READ MORE <a href=\"https:\/\/www.zdnet.com\/article\/ransomware-new-file-encrypting-attack-has-links-to-gandcrab-malware-say-security-researchers\/#ftag=RSSbaffb68\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Analysis of the REvil code reveals strong links to GandCrab &#8211; and researchers suggest that REevil even started life as a version of GandCrab.<br \/>\nREAD MORE HERE&#8230;<\/p>\n","protected":false},"author":2,"featured_media":29279,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[62],"tags":[],"class_list":["post-29278","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-zdnet-security"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Ransomware: New file-encrypting attack has links to GandCrab malware, say security researchers 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/ransomware-new-file-encrypting-attack-has-links-to-gandcrab-malware-say-security-researchers\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Ransomware: New file-encrypting attack has links to GandCrab malware, say security researchers 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/ransomware-new-file-encrypting-attack-has-links-to-gandcrab-malware-say-security-researchers\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2019-09-24T14:26:35+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2019\/09\/ransomware-new-file-encrypting-attack-has-links-to-gandcrab-malware-say-security-researchers.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"770\" \/>\n\t<meta property=\"og:image:height\" content=\"578\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-new-file-encrypting-attack-has-links-to-gandcrab-malware-say-security-researchers\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-new-file-encrypting-attack-has-links-to-gandcrab-malware-say-security-researchers\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"Ransomware: New file-encrypting attack has links to GandCrab malware, say security researchers\",\"datePublished\":\"2019-09-24T14:26:35+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-new-file-encrypting-attack-has-links-to-gandcrab-malware-say-security-researchers\\\/\"},\"wordCount\":603,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-new-file-encrypting-attack-has-links-to-gandcrab-malware-say-security-researchers\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/09\\\/ransomware-new-file-encrypting-attack-has-links-to-gandcrab-malware-say-security-researchers.jpg\",\"articleSection\":[\"ZDNet | Security\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-new-file-encrypting-attack-has-links-to-gandcrab-malware-say-security-researchers\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-new-file-encrypting-attack-has-links-to-gandcrab-malware-say-security-researchers\\\/\",\"name\":\"Ransomware: New file-encrypting attack has links to GandCrab malware, say security researchers 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-new-file-encrypting-attack-has-links-to-gandcrab-malware-say-security-researchers\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-new-file-encrypting-attack-has-links-to-gandcrab-malware-say-security-researchers\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/09\\\/ransomware-new-file-encrypting-attack-has-links-to-gandcrab-malware-say-security-researchers.jpg\",\"datePublished\":\"2019-09-24T14:26:35+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-new-file-encrypting-attack-has-links-to-gandcrab-malware-say-security-researchers\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-new-file-encrypting-attack-has-links-to-gandcrab-malware-say-security-researchers\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-new-file-encrypting-attack-has-links-to-gandcrab-malware-say-security-researchers\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/09\\\/ransomware-new-file-encrypting-attack-has-links-to-gandcrab-malware-say-security-researchers.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/09\\\/ransomware-new-file-encrypting-attack-has-links-to-gandcrab-malware-say-security-researchers.jpg\",\"width\":770,\"height\":578},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-new-file-encrypting-attack-has-links-to-gandcrab-malware-say-security-researchers\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Ransomware: New file-encrypting attack has links to GandCrab malware, say security researchers\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Ransomware: New file-encrypting attack has links to GandCrab malware, say security researchers 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/ransomware-new-file-encrypting-attack-has-links-to-gandcrab-malware-say-security-researchers\/","og_locale":"en_US","og_type":"article","og_title":"Ransomware: New file-encrypting attack has links to GandCrab malware, say security researchers 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/ransomware-new-file-encrypting-attack-has-links-to-gandcrab-malware-say-security-researchers\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2019-09-24T14:26:35+00:00","og_image":[{"width":770,"height":578,"url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2019\/09\/ransomware-new-file-encrypting-attack-has-links-to-gandcrab-malware-say-security-researchers.jpg","type":"image\/jpeg"}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/ransomware-new-file-encrypting-attack-has-links-to-gandcrab-malware-say-security-researchers\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/ransomware-new-file-encrypting-attack-has-links-to-gandcrab-malware-say-security-researchers\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"Ransomware: New file-encrypting attack has links to GandCrab malware, say security researchers","datePublished":"2019-09-24T14:26:35+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/ransomware-new-file-encrypting-attack-has-links-to-gandcrab-malware-say-security-researchers\/"},"wordCount":603,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/ransomware-new-file-encrypting-attack-has-links-to-gandcrab-malware-say-security-researchers\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2019\/09\/ransomware-new-file-encrypting-attack-has-links-to-gandcrab-malware-say-security-researchers.jpg","articleSection":["ZDNet | Security"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/ransomware-new-file-encrypting-attack-has-links-to-gandcrab-malware-say-security-researchers\/","url":"https:\/\/www.threatshub.org\/blog\/ransomware-new-file-encrypting-attack-has-links-to-gandcrab-malware-say-security-researchers\/","name":"Ransomware: New file-encrypting attack has links to GandCrab malware, say security researchers 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/ransomware-new-file-encrypting-attack-has-links-to-gandcrab-malware-say-security-researchers\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/ransomware-new-file-encrypting-attack-has-links-to-gandcrab-malware-say-security-researchers\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2019\/09\/ransomware-new-file-encrypting-attack-has-links-to-gandcrab-malware-say-security-researchers.jpg","datePublished":"2019-09-24T14:26:35+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/ransomware-new-file-encrypting-attack-has-links-to-gandcrab-malware-say-security-researchers\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/ransomware-new-file-encrypting-attack-has-links-to-gandcrab-malware-say-security-researchers\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/ransomware-new-file-encrypting-attack-has-links-to-gandcrab-malware-say-security-researchers\/#primaryimage","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2019\/09\/ransomware-new-file-encrypting-attack-has-links-to-gandcrab-malware-say-security-researchers.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2019\/09\/ransomware-new-file-encrypting-attack-has-links-to-gandcrab-malware-say-security-researchers.jpg","width":770,"height":578},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/ransomware-new-file-encrypting-attack-has-links-to-gandcrab-malware-say-security-researchers\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"Ransomware: New file-encrypting attack has links to GandCrab malware, say security researchers"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/29278","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=29278"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/29278\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media\/29279"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=29278"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=29278"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=29278"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}