Germany Identifies Suspected REvil and GandCrab Leader
Summary
German authorities identified Daniil Maksimovich Shchukin as a suspected leader of GandCrab and REvil, attributing at least 130 attacks in Germany to the group between 2019 and 2021.
Key points
- The BKA identified Russian national Daniil Maksimovich Shchukin as the suspected operator known as “UNKN” or “UNKNOWN.”
- Investigators attribute at least 130 attacks in Germany between 2019 and 2021 to Shchukin and the ransomware operations.
- Authorities allege Shchukin and another suspect extorted nearly €2 million and caused more than €35 million in economic damage.
- The article describes GandCrab’s affiliate model and REvil’s expansion into targeting larger organizations and using double extortion.
- The 2021 Kaseya attack reportedly affected more than 1,500 businesses; the article says subsequent law-enforcement actions, including a free decryption key, weakened REvil.
- German authorities believe Shchukin is abroad, presumably in Russia, and beyond their immediate reach.
Article Details
- Event Type
- German authorities identified a suspected leader of the GandCrab and REvil ransomware operations.
- Impact
- Investigators attribute at least 130 attacks in Germany between 2019 and 2021 to the operations. Authorities allege Daniil Maksimovich Shchukin and Anatoly Sergeevitsch Kravchuk carried out coordinated attacks that extorted nearly €2 million and caused more than €35 million in economic damage. The article also reports that the 2021 Kaseya attack affected over 1,500 businesses worldwide.
MITRE ATT&CK
Threat Actors
Anatoly Sergeevitsch KravchukAuthorities allege he carried out coordinated ransomware attacks with Daniil Maksimovich Shchukin.REvilRansomware operation described as conducting attacks and popularizing double extortion.UNKNGerman authorities identified him as the suspected leader of GandCrab and REvil and attributed involvement in attacks in Germany to him.
Malware
GandCrabDaniil Maksimovich Shchukin to the aliases “UNKN”/”UNKNOWN” and identified him as a leader of the GandCrab and REvil operations tied to at least 130 attacks in Germany between 2019 and 2021.REvilMaksimovich Shchukin to the aliases “UNKN”/”UNKNOWN” and identified him as a leader of the GandCrab and REvil operations tied to at least 130 attacks in Germany between 2019 and 2021.