group behind the notorious Gandcrab Ransomware quits. The makers say they stop because they have earned enough money from the hostage malware without being tackled by investigative agencies.

The anonymous team behind Gandcrab has left a farewell message in various forums on the dark web where it spread its ransomware. Screenshots can be seen at Bleeping Computer . Gandcrab has been one of the most notorious and most common forms of ransomware in recent years. The makers now say they are stopping for ‘a well-earned pension’. “We have proven that we can do malicious things without seeing retribution,” they write in their forum post. Investigation services often find it difficult to catch ransomware makers; the chance of being caught is low for large distributors.

The makers stop selling their ransomware, and ask their buyers to stop distributing the ransomware. Most likely it also means that the makers take their command and control servers offline, but they don’t write that themselves. They do state that the decryption keys are deleted after twenty days and that victims can then no longer decrypt their files. In most cases, victims of Gandcrab received their files back after payment. In the past, other ransomware gangs, such as those behind TeslaCrypt, have released all decryption keys after stopping operations.

Gandcrab was offered as ‘ransomware-as-a-service’ in forums. Buyers could then use the ransomware themselves for their own campaigns. They then only had to configure a few things themselves, such as the text in the ransom letter, the ransom amount, and the encryption method. The original makers got a percentage of that. According to the makers, buyers have earned more than two billion dollars in total, leaving them $ 150 million left. It is difficult to check whether those amounts are correct.