German Authorities Identify Suspected GandCrab and REvil Leaders, Obtain Arrest Warrants
Summary
German investigators say they identified the suspected leader of GandCrab and REvil and a suspected malware programmer, securing national and European arrest warrants. The suspects are also accused of involvement in a 2019 theater attack.
Key points
- Germany’s Cybercrime Center and Baden-Württemberg State Office of Criminal Investigation say they identified the suspected leader of GandCrab and REvil and a suspected programmer, and obtained national and European arrest warrants.
- The suspects are accused of being partly responsible for the 2019 attack on the Württemberg State Theatres in Stuttgart.
- Authorities allege GandCrab operated in 2018–2019 and that members, including the suspects, formed REvil in 2019 and continued attacks through July 2021.
- The groups allegedly used a ransomware-as-a-service model: affiliates broke into victim networks, while REvil affiliates also exfiltrated sensitive data before encryption and ransom demands.
- Investigators cite analysis of extensive datasets, including cryptocurrency transactions, and cooperation with law-enforcement partners in Europe and North America.
- The suspects have been placed on the EU Most Wanted list, and further efforts to apprehend them are being coordinated internationally.
Article Details
- Event Type
- Authorities identified two suspected principal figures linked to the GandCrab and REvil ransomware groups and obtained national and European arrest warrants.
- Impact
- The suspects are accused of organizing or developing ransomware operations and are suspected of being connected to the 2019 attack on the Württembergische Staatstheater Stuttgart. The article describes the groups’ affiliates as breaching networks, encrypting systems and, in REvil’s case, exfiltrating sensitive data to support ransom demands. The suspects’ identities were made public and international efforts to locate them are being coordinated.
MITRE ATT&CK
Threat Actors
Anatoly Sergeevitsch KravchukNamed as one of the two wanted suspects whom authorities allege were principal figures linked to the GandCrab and REvil operations; the article does not specify which of the two alleged roles applies to him.REvilRansomware group described as active in 2018–2019; authorities suspect that members, including the two wanted suspects, later founded REvil.SodinokibiThe article explicitly identifies Sodinokibi as another name for REvil.UNKNNamed as one of the two wanted suspects whom authorities allege were principal figures linked to the GandCrab and REvil operations; the article does not specify which of the two alleged roles applies to him.
Malware
GandCrabOffice of Criminal Investigation have identified the alleged leader and alleged programmer behind the GandCrab and REvil ransomware groups and issued international arrest warrants.REvilCriminal Investigation have identified the alleged leader and alleged programmer behind the GandCrab and REvil ransomware groups and issued international arrest warrants.SodinokibiâREvil“ (auch âSodinokibi“ genannt) sowie den mutmaÃlichen Programmierer der von diesen Hackern genutzten