Germany’s BKA Names Two Suspects in 130 REvil Ransomware Attacks
Summary
Germany’s BKA identified REvil’s UNKN as Daniil Shchukin and added alleged developer Anatoly Kravchuk to its wanted list, suspecting them of 130 attacks. The cases reportedly caused over $40.8 million in damages, with $2.19 million in ransoms paid.
Key points
- Germany’s BKA identified the REvil affiliate known as UNKN as Daniil Maksimovich Shchukin.
- The BKA added Anatoly Sergeevitsch Kravchuk to its wanted list, alleging he was a REvil developer.
- The two men are suspected of involvement in 130 ransomware attacks in Germany.
- The article reports that 25 cases involved $2.19 million in ransom payments and that total damages exceeded $40.8 million.
- The BKA said the perpetrators demanded payment in exchange for decrypting data and not leaking it.
Article Details
- Event Type
- Law enforcement identification and wanted-list update concerning alleged REvil operators linked to ransomware attacks in Germany.
- Impact
- The BKA said Daniil Maksimovich Shchukin and Anatoly Sergeevitsch Kravchuk are suspected of involvement in 130 ransomware attacks in Germany. Twenty-five incidents reportedly resulted in €1.9 million in ransom payments, and total damages exceeded €35.4 million.
Threat Actors
0_nedayThe article says the user REvil, described as the gang’s public face, was later renamed to 0_neday.Anatoly Sergeevitsch KravchukAdded to the BKA wanted list and alleged to have developed REvil; the BKA suspects him of involvement in 130 ransomware attacks in Germany.Gold SouthfieldName identified in the article as an alias of the REvil ransomware group.Oneiilk2Online moniker used by Daniil Maksimovich Shchukin, whom the BKA alleges led a ransomware group.Oneillk2Online moniker used by Daniil Maksimovich Shchukin, whom the BKA alleges led a ransomware group.Oneillk22Online moniker used by Daniil Maksimovich Shchukin, whom the BKA alleges led a ransomware group.REvilRansomware group linked by the BKA to alleged attacks in Germany; the article also identifies it as a ransomware-as-a-service operation.SodinokibiName used for REvil in the article, which describes Sodinokibi as an alias of REvil.UNKNIdentified by the BKA as the person known as UNKN; the BKA alleges he led a major ransomware group and suspects him of involvement in 130 ransomware attacks in Germany.Water MareName identified in the article as an alias of the REvil ransomware group.
Malware
GandCrabover â¬35.4 million in damages (with â¬1.9 million in ransoms paid) and associated with the REvil/GandCrab operation that targeted victims including JBS and Kaseya.REvilGermany’s Federal Criminal Police Office (BKA) identified the REvil affiliate known as “UNKN” as 31-year-old Daniil Maksimovich Shchukin and added alleged developer Anatoly Sergeevitsch Kravchuk to its wanted list,SodinokibiREvil (aka Sodinokibi/GandCrab) operated as a RaaS with numerous affiliates and high-profile victims like JBS and Kaseya.
Countries
GermanyGermany’s Federal Criminal Police Office (BKA) identified the REvil affiliate known as “UNKN” as 31-year-old Daniil Maksimovich Shchukin and added alleged developer Anatoly Sergeevitsch Kravchuk to its wanted list,RussiaIn a rare move, Russia’s Federal Security Service (FSB) disclosed in January 2022 that it had arrested several members belonging to the notorious REvil ransomware gang and neutralized its operations.