REvil and GandCrab Attribution: Detecting TTPs of the UNKN Operation

---
title: Potential GandCrab Ransomware Note Creation
id: 9e8b1d2c-4a5f-4b3c-8d9e-1a2b3c4d5e6f
status: experimental
description: Detects the creation of GandCrab ransomware notes (html/txt) which are specific artifacts left by the gang led by UNKN.
references:
  - https://krebsonsecurity.com/2026/04/germany-doxes-unkn-head-of-ru-ransomware-gangs-revil-gandcrab/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.impact
  - attack.t1486
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - 'GANDCRAB'
      - 'DECRYPT'
    TargetFilename|endswith:
      - '.html'
      - '.txt'
  condition: selection
falsepositives:
  - Legitimate administrative scripts (rare)
level: critical
---
title: REvil (Sodinokibi) Ransomware Note Creation
id: a1b2c3d4-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects the creation of the characteristic _README_ ransom note used by REvil to instruct victims on payment.
references:
  - https://krebsonsecurity.com/2026/04/germany-doxes-unkn-head-of-ru-ransomware-gangs-revil-gandcrab/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.impact
  - attack.t1486
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith:
      - '_README_.TXT'
      - '_README_.hta'
      - '_README_.URL'
  condition: selection
falsepositives:
  - Legitimate readme files in software directories
level: critical
---
title: REvil Registry Persistence Indicator
id: b2c3d4e5-6f7a-8b9c-0d1e-2f3a4b5c6d7e
status: experimental
description: Detects registry key creation or modification consistent with REvil persistence mechanisms observed in UNKN-linked campaigns.
references:
  - https://krebsonsecurity.com/2026/04/germany-doxes-unkn-head-of-ru-ransomware-gangs-revil-gandcrab/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1547.001
logsource:
  category: registry_add
  product: windows
detection:
  selection:
    TargetObject|contains:
      - '\Software\REvil'
      - '\Software\Microsoft\Windows\CurrentVersion\RunOnce\'
    Details|contains:
      - 'decrypt'
      - 'restore'
  condition: selection
falsepositives:
  - Unknown
level: high

// Hunt for GandCrab and REvil ransom note artifacts
DeviceFileEvents
| where Timestamp > ago(30d)
| where FileName in~ ("GANDCRAB DECRYPTOR.html", "GANDCRAB DECRYPTOR.txt", "_README_.TXT", "_README_.hta")
   or FolderPath contains "GANDCRAB"
| project Timestamp, DeviceName, InitiatingProcessAccountName, FileName, FolderPath, SHA256
| extend SuspiciousScore = iff(FileName contains "GANDCRAB" or FileName contains "_README_", 10, 0)
| order by Timestamp desc

-- Hunt for UNKN-linked Ransomware Artifacts
SELECT 
  FullPath,
  Size,
  Mtime,
  Atime,
  Btime
FROM glob(globs=C:/Users/**/*)
WHERE 
  Name =~ "GANDCRAB.*" 
  OR Name =~ "_README_.*" 
  OR Name =~ "*.CRAB"
  OR Name =~ "*.GDCB"

-- Hunt for REvil Mutex (requires admin/sysmon)
SELECT 
  Pid, Name, CommandLine
FROM pslist()
WHERE 
  Name =~ ".*" 
  AND grep(query='MsWinZzsCacheLockMutex', string=CommandLine)

<#
.SYNOPSIS
    Security Arsenal Incident Response - Scan for UNKN/REvil/GandCrab IOCs.
.DESCRIPTION
    Scans file system for specific ransom notes and registry for persistence keys.
#>

Write-Host "[+] Starting scan for REvil/GandCrab IOCs..." -ForegroundColor Cyan

# 1. Scan for Ransom Notes
$paths = @("C:\Users\", "C:\ProgramData\", "D:\")
$indicators = @("*_README_.*", "*GANDCRAB*", "*.CRAB", "*.GDCB")
$found = $false

foreach ($path in $paths) {
    if (-not (Test-Path $path)) { continue }
    Write-Host "[+] Scanning $path..." -ForegroundColor Gray
    foreach ($ind in $indicators) {
        try {
            $files = Get-ChildItem -Path $path -Filter $ind -Recurse -ErrorAction SilentlyContinue -Force
            if ($files) {
                $found = $true
                foreach ($file in $files) {
                    Write-Host "[!] THREAT DETECTED: $($file.FullName)" -ForegroundColor Red
                }
            }
        } catch {
            # Ignore access denied errors
        }
    }
}

# 2. Scan Registry for REvil Persistence
Write-Host "[+] Scanning Registry..." -ForegroundColor Gray
$regPaths = @("Registry::\HKEY_CURRENT_USER\Software", "Registry::\HKEY_LOCAL_MACHINE\Software")
foreach ($regPath in $regPaths) {
    try {
        $keys = Get-ChildItem -Path $regPath -Recurse -ErrorAction SilentlyContinue | Where-Object { $_.Name -like "*REvil*" -or $_.Name -like "*GandCrab*" }
        if ($keys) {
            $found = $true
            foreach ($key in $keys) {
                Write-Host "[!] REGISTRY THREAT DETECTED: $($key.Name)" -ForegroundColor Red
            }
        }
    } catch {
        # Ignore access denied errors
    }
}

if (-not $found) {
    Write-Host "[+] No specific IOCs found. System appears clean of these specific artifacts." -ForegroundColor Green
} else {
    Write-Host "[!] CRITICAL: IOCs detected. Isolate host immediately and begin IR procedures." -ForegroundColor Red
}