Hackers infected the wrong girlfriend....

Cybercrime investigators at Bitdefender’s Romania-based “Draco” team say the fight is far from won—but they’ve repeatedly disrupted ransomware business models by breaking the trust between ransomware developers and the affiliates who deliver infections. The most striking case involved GangCrab, a ransomware operation that had dominated roughly half the market at its peak and used a franchise-like structure: a core group built and improved the malware, while vetted affiliates distributed it and split profits. When GangCrab infected the girlfriend of a top penetration tester, Draco treated it as a personal, long-running campaign—waiting out the slow pace of law enforcement, then striking indirectly by targeting the operation’s ability to monetize new victims.

Draco’s method centered on decryption tools. After GangCrab encrypted victims’ files, Draco produced decryptors that could restore data—undercutting the ransomware’s leverage. But GangCrab responded by modifying its malware whenever a public decryptor appeared, forcing Draco to release updated tools repeatedly. Over about two and a half years, Draco released five decryption tools. Each iteration didn’t just help victims; it also eroded confidence inside the ransomware ecosystem. Affiliates began shifting away to other groups, and the developers lost the operational manpower needed to keep infections flowing. The ransomware group eventually disappeared from the public stage, claiming it had made enough money—only to reappear later in other forms.

The briefing also highlights why these disruptions matter financially and personally. Draco estimates that decryptors helped stop roughly $1 billion from being paid in a later case involving “Rebel,” also known as “Sobi,” a Russia-linked ransomware crew that shared about 50% of its code with GangCrab. In that scenario, Draco produced another decryptor and released it for free, while a backdoor discovered in the malware suggested Rebel was cheating affiliates out of their cut. That internal betrayal, combined with the decryptor’s impact, helped dismantle the operation.

Beyond ransomware, the team argues that AI has shifted the balance for criminals. With AI, scammers can generate more convincing phishing messages, improve code, and clone voices in seconds—enabling fraud that looks and sounds authentic even to experts. Bitdefender’s response is described as an “AI arms race” rather than relying on static defenses like grammar checks or template detection. The company built an AI defense team that focuses on deepfake detection with intent analysis (not just whether audio/video is synthetic), and on scammer “honeypots” that tie up fraudsters by engaging them with an AI persona while collecting intelligence such as URLs and behavioral red flags.

Draco’s bottom line is that stopping cybercrime completely may be unrealistic, but reducing harm is measurable: decryptors saved victims from paying ransoms, and the team’s work is framed as protecting real people—from researchers who lose months of work to ransomware, to families whose hostage-held photos represent the only surviving proof of loved ones. The message is blunt: criminals adapt quickly, but defenders can still dent the enterprise by targeting the incentives, trust, and operational pipelines that make ransomware and scams profitable.