REvil and GandCrab ransomware operations highlight critical defensive gaps

German authorities identified two Russian nationals who led GandCrab and REvil ransomware operations that successfully attacked at least 130 German companies between 2019-2021, causing over $40 million in damages. These operations succeeded because organizations lacked adequate incident response capabilities and reliable backup systems to recover from attacks without paying ransoms. The scale of damage demonstrates how ransomware groups exploit weaknesses in business continuity planning and recovery procedures. While law enforcement identification is important, the primary defense against such attacks lies in robust backup strategies and incident response preparedness.

Tactical Insight

Immediate actions

Implement automated, offline backup systems with regular recovery testing
Establish an incident response team with defined roles and communication protocols
Deploy endpoint detection and response (EDR) tools across all systems

Long-term improvements

Develop and regularly test comprehensive business continuity and disaster recovery plans
Create network segmentation to isolate critical systems from potential ransomware spread
Establish partnerships with cybersecurity firms for emergency incident response support

Detection and monitoring

Implement continuous monitoring for suspicious file encryption activities
Deploy behavioral analytics to detect lateral movement patterns typical of ransomware attacks