Who’s Behind the Gand Crab Ransomware?
Summary: The operators of the GandCrab ransomware affiliate program announced on May 31, 2019 that they were shutting down after allegedly earning more than $2 billion in extortion payouts from victims, with the group itself claiming over $150 million. KrebsOnSecurity traced forum and account records pointing to a Russian man, Igor Vladimirovich Prokopenko of Magnitogorsk, as the person who appeared to handle recruiting new affiliates, and he responded only with 'Hey. You're wrong. I'm not doing this.'
What's compelling: Kaspersky Lab estimated GandCrab accounted for up to half the global ransomware market before it closed, and the group's own farewell post claimed the average weekly income of the project was $2.5 million - a reminder that an affiliate program shut down on its own terms, not by arrest, can leave its operators free to retire on the proceeds.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026