German Law Enforcement Publicly Attributes Ransomware Leadership - Implications for Accountability and Risk Exposure

Germany’s Federal Criminal Police, the Bundeskriminalamt (BKA), has put a name to UNKN, the handle behind the GandCrab and REvil ransomware operations. The BKA identifies him as Daniil Maksimovich Shchukin, a 31-year-old Russian from Krasnodar, and says he headed both groups and helped carry out at least 130 acts of computer sabotage and extortion against victims across Germany between 2019 and 2021.

The same advisory names a second Russian, 43-year-old Anatoly Sergeevitsch Kravchuk. The BKA says the two extorted nearly €2 million across about two dozen attacks that together caused more than €35 million in economic damage.

GandCrab and REvil are credited with popularising double extortion: one payment for the key to unlock encrypted systems, and a separate payment for a promise not to publish the data stolen on the way in. Shchukin’s name is not new to the record. A February 2023 US Justice Department filing seeking to seize cryptocurrency tied to REvil’s proceeds listed him, and the wallet attributed to him held more than $317,000.

GandCrab’s affiliate program surfaced in January 2018 and paid affiliates large cuts simply for breaking into accounts at big companies. The operators would expand that foothold and siphon internal documents, and they shipped five major revisions of the code, each adding features meant to stay ahead of the security firms trying to break it. On May 31, 2019 the group announced it was shutting down, claiming it had extorted more than $2 billion. Its farewell note bragged, “We are a living proof that you can do evil and get off scot-free.”

REvil appeared around the same time. UNKNOWN announced himself on a Russian crime forum by depositing $1 million into the forum’s escrow, and plenty of analysts read REvil as a straight reorganisation of GandCrab. In an interview with Dmitry Smilyanets of Recorded Future, UNKNOWN gave a rags-to-riches account: “As a child, I scrounged through the trash heaps and smoked cigarette butts,” he said, adding that he once went two or three days without eating and now was a millionaire.

The operation ran like a business. As documented in The Ransomware Hunting Team by Renee Dudley and Daniel Golden, REvil reinvested its earnings into better malware and outsourced the rest: cryptor providers to keep payloads past anti-malware scanners, initial access brokers who sold stolen credentials and network footholds, and Bitcoin tumblers that offered discounts to repeat customers. Ransomware the defenders could not crack meant more and larger payouts, which funded more specialists.

REvil put that machine to work on big-game hunting, favouring organisations above $100 million in annual revenue that carried cyber insurance policies known to pay. Over the July 4, 2021 weekend it hit Kaseya, whose software handled IT operations for more than 1,500 businesses, nonprofits and government agencies. The FBI later said it had been inside REvil’s servers before the Kaseya attack but held back rather than tip its hand; it eventually released a free decryption key, and REvil never recovered from the compromise.

The attribution is worth reading closely, because the direct link between Shchukin and UNKNOWN’s forum accounts is thin. The connecting evidence is circumstantial. Intel 471’s index of Russian crime forums ties Shchukin to a hacker called “Ger0in” who ran large botnets and sold “installs,” the ability to push chosen malware onto thousands of machines at once, but that activity ran only in 2010 and 2011, years before UNKNOWN appeared. Krebs ran the BKA mugshots through the facial-search site Pimeyes and matched them to a 2023 birthday photo of a man named Daniel wearing the same watch as in the police images. A 2023 talk at the 37C3 conference in Germany had already named Shchukin as the REvil leader.

Shchukin is presumed to be in Russia, which is as far as this goes for now. The BKA says it assumes he is abroad, “presumably in Russia,” but adds that travel behaviour cannot be ruled out. With extradition off the table, the published name, face and wallet seizure are the accountability on offer, and the travel note is the part with practical weight: a named suspect with a usable photo becomes arrestable the day he crosses into a cooperating jurisdiction.

See also: NordVPN for tunneled traffic when operating outside controlled networks.

---

#ad Contains an affiliate link.