Cyber Operations — 2026-04-07

German BKA Unmasks REvil/GandCrab Ransomware Leader UNKN as Russian National

Germany's Federal Criminal Police (BKA) publicly identified 31-year-old Russian national Daniil Maksimovich Shchukin as UNKN, the leader of both the GandCrab and REvil ransomware operations. Shchukin and 43-year-old Anatoly Sergeevitsch Kravchuk are accused of conducting at least 130 cyberattacks against German targets between 2019 and 2021, causing over 35 million euros in economic damage. REvil pioneered the double-extortion model, charging victims separately for decryption keys and for not publishing stolen data.

Analysis
Public attribution of REvil/GandCrab leadership by name marks a law enforcement posture shift from sealed indictments to deterrence-by-naming. Shchukin remains in Russia and is effectively beyond extradition. The BKA's willingness to identify him publicly suggests the intelligence value of secrecy has been exhausted.
2 sources
  1. Germany Doxes UNKN, Head of RU Ransomware Gangs REvil, GandCrab - Krebs on Security
  2. German police unmask two suspects linked to REvil ransomware gang - The Record

View in full brief →

UNCLASSIFIED // OPEN SOURCE