Gandcrab Ransomware Walks its Way onto Compromised Sites
Summary: Cisco Talos reported that the Gandcrab ransomware was being distributed through spam campaigns and the Rig and Grandsoft exploit kits, using compromised websites to host payloads. The campaign used Word macros and VBScript files to pull down the payload, in one case via certutil.exe with the -urlcache, -split and -f flags to force a download from hxxp://185.189.58[.]222/bam.exe.
What's compelling: Talos saw four different spam campaigns using compromised sites in a single week, and one site served Gandcrab twice over a few days despite being briefly shut down - so a cleaned site is not necessarily a fixed one.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026