The GandCrab ransomware TOR site allows shady data recovery companies to hide the actual ransom cost from victims and it is currently being disseminated through a large assortment of distribution channels according to a Codeware report. Partnering with recovery firms who frequently access GandCrab’s TOR site is an https://www.coveware.com/blog/2018/10/10/gandcrab-ransomware-decryption-payment, with “discount” codes being provided to the most active ones, usable when processing future settlements.
Source: Bleeping Computer
