A recent study by Recorded Future found that the retirement of the GandCrab ransomware group earlier this year has created a ransomware demand vacuum on underground forums. The study indicates that around half of posts on underground forums are from cybercriminals looking for an alternative to the GandCrab ransomware-as-a-service solution. At the same time, malware developers are trying to meet the demand by distributing new ransomware strains.
Winnona DeSombre of Recorded Future told Threatpost that a large number of threat actors are interested in ransomware, but they “don’t know where to look,” especially because “since GandCrab has retired… there’s not really a vendor that has reached that level of popularity yet.” DeSombre is worried about “what vendor will emerge as the new primary ransomware vendor.”
Read more: Post GandCrab, Cybercriminals Scouring the Dark Web for the Next Top Ransomware