Belarus Authorities Arrest GandCrab Ransomware Operator

The Ministry of Internal Affairs of Belarus has announced the arrest of a 31-year-old man who served as an affiliate in the infamous GandCrab ransomware-as-a-service program.

“Office “K” of the Ministry of Internal Affairs, in cooperation with the Cyber ​​police of Great Britain and Romania, identified a member of an international hacker group that used during 2017-2018, one of the most famous ransomware virus “GandCrab,”” reads a rough English translation of the press release. “On their account – more than 54 thousand infected computers around the world, 165 of which belong to the citizens of Belarus.”

Vladimir Zaitsev, deputy head of the High-Tech Crime Department of the Ministry of Internal Affairs, says the hacker, who has yet to be named, is a 31-year-old resident of Gomel who had no prior convictions. He allegedly infected more than 1,000 computers and demanded the equivalent of $1,200 for decrypting each one.

“Access to the admin panel for managing the ransomware botnet was carried out via the darknet, which allowed the attacker to remain anonymous for a long time,” the news release states.

“Part of the profits was transferred to the administrators (operators) of the server he leased,” Zaitsev said.

The hacker”s victims span several countries, including India, the US, Ukraine, UK, Germany, France, Italy and Russia – where most of his victims resided.

Last week, Europol announced that the No More Ransom decryption tool repository had amassed over 4.2 million visitors from 188 countries as the service turned four years old. The agency said the repo helped save an estimated $632 million for ransomware victims worldwide. Bitdefender calculates that its GandCrab decryptors alone are responsible for 12% of that figure.