Europol, FBI, Bitdefender, and others release a free tool to decrypt GandCrab ransomware, thought to have infected 1.5M+ Windows PCs since January 2018
Recover Files for Free Mark Wyciślik-Wilson / BetaNews : BitDefender releases free decryption tool for GandCrab ransomware Shaun Nichols / The Register : Smash GandCrab: Free tools released to decrypt files scrambled by notorious ransomware JC Torres / SlashGear : GrandCrab ransomware authors retire after earning $2 billion Pierluigi Paganini / Security Affairs : A free Decryptor tool for GandCrab Ransomware released Dark Reading : New Decryptor Unlocks Latest Versions of Gandcrab
Context & Ripple Effects
This decryptor is the latest output of the No More Ransom coalition Europol has run since 2016, pairing law enforcement with security vendors like Bitdefender to break ransomware encryption at scale. The playbook has precedents: the TeslaCrypt developers' shutdown came with a released master key, and a flaw let researchers free WannaCry victims on un-rebooted machines.
GandCrab is a bigger prize than either — over 1.5 million infected Windows PCs since January 2018 — and the tool lands just as the gang reportedly retires with an estimated $2 billion in ransom payments. The same state-plus-vendor template resurfaces years later when the FBI distributes seized LockBit decryption keys to victims.
First-order effects
- Victims of GandCrab across its 1.5M+ infections gain a no-cost recovery path from Europol, the FBI, and Bitdefender, undercutting any remaining pressure to pay the gang.
- Bitdefender converts the takedown into product credibility, reinforcing the vendor role in the No More Ransom pipeline it already supplies.
Second-order effects
- Active ransomware crews lose negotiating leverage whenever a coalition tool ships, pushing them toward faster campaigns before researchers catch up — the dynamic Europol later quantified at $108M in blocked profits for the program overall.
- Law enforcement agencies get a repeatable formula: seize or extract keys, then distribute them through vendors, as the FBI does with LockBit in 2024.
Third-order effects
- If the TeslaCrypt–WannaCry–GandCrab–LockBit sequence holds, ransomware economics structurally shift toward assuming decryption may arrive free, eroding the pay-or-lose-files business model itself.
- The trusted-tool boundary tightens around these releases: victims must weigh running a government-vendor binary on already-compromised machines, making distribution channels like No More Ransom part of the security infrastructure.
The trend: Public-private decryption coalitions are turning ransomware's core asset — exclusive control of victims' files — into a depreciating one, with each seized key set lowering the expected return on attacks.