German Police Identify Alleged GandCrab and REvil Leader
Summary
Germany’s BKA identified Russian national Daniil Maksimovich Shchukin as the alleged leader of GandCrab and REvil, linking him to 130 extortion attempts and more than $40 million in estimated damages.
Key points
- The BKA says Shchukin led the GandCrab and REvil operations from early 2019 to mid-2021.
- The BKA attributes 130 extortion attempts to Shchukin, including 25 in which victims paid more than $2 million in total.
- The activities are estimated to have caused more than $40 million in damages.
- The BKA identified Russian national Anatoly Sergeevitsch Kravchuk as one of Shchukin’s alleged co-conspirators; the operations targeted enterprises and public institutions.
- Law enforcement seized REvil’s servers in 2021, and seven people associated with the operations were arrested; four group members were sentenced in 2024.
Article Details
- Event Type
- Law enforcement identification of an alleged ransomware leader
- Impact
- The BKA says Daniil Maksimovich Shchukin led the GandCrab and REvil operations from early 2019 to mid-2021 and was involved in 130 extortion attempts. The BKA reports that 25 victims paid more than $2 million in ransom and estimates total damages at more than $40 million.
Threat Actors
Anatoly Sergeevitsch KravchukThe BKA identifies him as a co-conspirator in the ransomware operations.Oneiilk2The article identifies this as an alias of Daniil Maksimovich Shchukin, whom the BKA names as a ransomware-operation leader.Oneillk2The article identifies this as an alias of Daniil Maksimovich Shchukin, whom the BKA names as a ransomware-operation leader.Oneillk22The article identifies this as an alias of Daniil Maksimovich Shchukin, whom the BKA names as a ransomware-operation leader.REvilThe BKA says Shchukin led the GandCrab ransomware operation; the article also lists GandCrab as an alias used by Shchukin.SodinokibiThe article identifies Sodinokibi as an alternate name for the REvil ransomware operation, which the BKA says Shchukin led.UNKNThe BKA identifies him as the leader of the GandCrab and REvil ransomware operations and says he was involved in 130 extortion attempts.
Malware
GandCrabThe German Federal Criminal Police (BKA) has named a Russian national as the mastermind behind the GandCrab and REvil ransomware operations.REvilThe German Federal Criminal Police (BKA) has named a Russian national as the mastermind behind the GandCrab and REvil ransomware operations.SodinokibiREvil (aka Sodinokibi) emerged around the same time as GandCrab was retiring and was immediately labeled as its successor. In late 2021, law enforcement seized REvil’s servers, and seven individuals associated with the