Germany has publicly identified the alleged operator behind one of the most infamous ransomware ecosystems, marking a significant development in the global fight against organized cybercrime.<\/p>\n
The German Federal Criminal Police Office (BKA) has named 31-year-old Russian national Daniil Maksimovich Shchukin as the individual operating under the alias \u201cUNKN,\u201d a figure long associated with the GandCrab and REvil ransomware groups. <\/p>\n
The attribution, based on extensive investigations, provides rare insight into the leadership structure of two operations that reshaped the modern ransomware landscape.<\/p>\n
According to authorities, <\/a>Shchukin worked closely with 43-year-old Anatoly Sergeevitsch Kravchuk, coordinating at least 130 cyberattacks targeting organizations across Germany between 2019 and 2021. <\/p>\n These campaigns reportedly generated approximately \u20ac2 million in ransom payments while inflicting more than \u20ac35 million in broader economic damage through operational disruption and recovery costs.<\/p>\n Under Shchukin\u2019s alleged leadership, GandCrab and its successor REvil pioneered the now widely adopted \u201cdouble extortion\u201d model. <\/p>\n This approach significantly increased pressure on victims by combining two tactics: encrypting critical systems to halt operations and exfiltrating sensitive data for use as additional leverage. <\/p>\n Victims were forced to pay not only for decryption keys but also to prevent public data leaks, dramatically improving attackers\u2019 success rates.<\/p>\n GandCrab first emerged in early 2018 as a Ransomware-as-a-Service (RaaS)<\/a> platform, allowing affiliates to deploy the malware in exchange for a share of ransom profits. <\/p>\n This scalable, franchise-like model accelerated adoption among cybercriminals. When GandCrab abruptly shut down in 2019, claiming over $2 billion in illicit earnings, REvil quickly appeared, reusing much of the same infrastructure, tooling, and affiliate network. <\/p>\n Security researchers widely viewed REvil as a direct evolution rather than a new operation.<\/p>\n REvil operated with a level of organization comparable to a legitimate enterprise. The group reinvested profits into development and outsourced key functions within the cybercriminal ecosystem. <\/p>\n Initial network access was often purchased from specialized brokers, while financial flows were handled by professional money launderers. <\/p>\n This division of labor enabled core developers to focus on refining encryption techniques designed to evade detection by traditional security tools.<\/p>\n The group also adopted a \u201cbig-game hunting\u201d strategy, targeting large enterprises with substantial financial resources and cyber insurance coverage. <\/p>\n One of the most damaging incidents attributed to REvil occurred during the July 4 weekend in 2021, when attackers compromised Kaseya, a widely used IT management platform. <\/p>\n The resulting supply chain attack disrupted more than 1,500 businesses globally, underscoring the systemic risk posed by ransomware groups targeting service providers.<\/p>\n However, this high-profile campaign contributed to REvil\u2019s eventual downfall. Law enforcement agencies, including the FBI, managed to infiltrate the group\u2019s infrastructure and obtain decryption keys, which were later distributed to victims. <\/p>\n The operation significantly weakened REvil\u2019s capabilities and marked a turning point in coordinated international responses to ransomware.<\/p>\n Despite the identification of Shchukin, enforcement challenges remain. German authorities believe he is currently residing in Krasnodar, Russia, placing him beyond the immediate reach of extradition. <\/p>\n Nevertheless, financial disruption efforts continue. In 2023, the U.S. Department of Justice seized more than $317,000 in cryptocurrency linked to wallets allegedly controlled by Shchukin.<\/p>\n The unmasking of \u201cUNKN\u201d highlights both progress and limitations in combating transnational cybercrime, where attribution is improving but jurisdictional barriers still hinder prosecution.<\/p>\n Follow us on\u00a0Google News<\/a>\u00a0,\u00a0LinkedIn<\/a>\u00a0and\u00a0X<\/a>\u00a0to Get More Instant Updates.\u00a0Set Cyberpress as a Preferred Source in\u00a0Google<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"Germany has publicly identified the alleged operator behind one of the most infamous ransomware ecosystems, marking a significant…\n","protected":false},"author":2,"featured_media":2642,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[2856,2857,5],"class_list":{"0":"post-2641","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-germany","8":"tag-cyber-security","9":"tag-cyber-security-news","10":"tag-germany"},"_links":{"self":[{"href":"https:\/\/www.europesays.com\/germany\/wp-json\/wp\/v2\/posts\/2641","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.europesays.com\/germany\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.europesays.com\/germany\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/germany\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/germany\/wp-json\/wp\/v2\/comments?post=2641"}],"version-history":[{"count":0,"href":"https:\/\/www.europesays.com\/germany\/wp-json\/wp\/v2\/posts\/2641\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/germany\/wp-json\/wp\/v2\/media\/2642"}],"wp:attachment":[{"href":"https:\/\/www.europesays.com\/germany\/wp-json\/wp\/v2\/media?parent=2641"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.europesays.com\/germany\/wp-json\/wp\/v2\/categories?post=2641"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.europesays.com\/germany\/wp-json\/wp\/v2\/tags?post=2641"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}