UNKN Unmasked: German Police Identify Head of REvil and GandCrab Ransomware Gangs

UNKN identified: the man behind GandCrab and REvil

German federal police (BKA) released an advisory naming 31‑year‑old Daniil Maksimovich Shchukin as the operator behind the moniker UNKN. Shchukin, a Krasnodar native, is accused of directing more than ↑ €2 million in ransom payments and orchestrating at least 130 sabotage incidents between 2019 and 2021.

Financial impact and criminal network

Together with 43‑year‑old Anatoly Sergeevich Kravchuk, the duo allegedly extracted close to ↓ €35 million in total economic damage across two dozen attacks, according to the BKA.

“We are living proof that you can do evil and get off scot‑free,” the GandCrab farewell note read.

The REvil operation, which succeeded GandCrab, pioneered double‑extortion – demanding a decryption key and a separate payment to keep stolen data private. U.S. Justice Department filings from February 2023 linked a cryptocurrency wallet tied to Shchukin to more than $317,000 in illicit proceeds. Reuters reported that the FBI infiltrated REvil’s servers before the infamous July 2021 Kaseya breach, but the agency kept the operation secret until after the attack. The Kaseya incident highlighted how ransomware groups now target “big‑game‑hunting” victims with revenues over $100 million and robust cyber‑insurance policies. Infrastructure and affiliates – from initial‑access brokers to crypto tumblers – formed a thriving underground supply chain that mirrored legitimate business practices, as detailed in the book Ransomware Hunting Team. nuclear security experts warn that similar models could be weaponised against critical infrastructure. While Shchukin is believed to remain in Russia, German investigators say travel cannot be ruled out. *Correction: An earlier dispatch misstated the year of the GandCrab shutdown; it occurred in 2019.*