German Authorities Unmask ‘UNKN’ Leader of REvil and GandCrab Ransomware Gangs
Featured image: Photo by Kindel Media on Pexels.
In a significant development for international cybersecurity, German authorities have successfully unmasked the individual known by the elusive handle “UNKN,” identifying him as the alleged architect and leader behind two of the most prolific and damaging ransomware operations in recent history: GandCrab and REvil. This breakthrough represents a critical step in the ongoing global fight against cybercrime, shedding light on the individuals who orchestrate sophisticated digital extortion schemes. The unmasking reveals the identity of a 31-year-old Russian national, Daniil Maksimovich Shchukin, who is now publicly linked to a vast network of cyberattacks and financial extortions that plagued the digital landscape between 2019 and 2021 [1].
The Federal Police in Germany (Bundeskriminalamt, or BKA), working alongside international partners, conducted a detailed investigation that pieced together operational patterns, financial flows, and infrastructure tied to the ransomware campaigns. Through forensic analysis, intelligence sharing, and coordination with European and U.S. authorities, investigators were able to connect the online persona “UNKN” to Shchukin. German officials subsequently issued a public notice naming him as a wanted suspect in connection with organized cyber extortion operations [2].
The Rise of GandCrab and REvil
GandCrab first emerged in early 2018 and quickly became one of the most widespread ransomware-as-a-service (RaaS) platforms ever observed. The operation allowed affiliates to deploy ransomware in exchange for a share of the profits, dramatically lowering the barrier to entry for cybercriminals. Within months, GandCrab had infected hundreds of thousands of systems worldwide, targeting businesses, municipalities, and individual users.
By mid-2019, the operators behind GandCrab claimed to have earned over $2 billion in ransom payments, although independent estimates place the figure somewhat lower. Regardless of the exact total, the campaign demonstrated how ransomware-as-a-service models could industrialize cybercrime, turning it into a scalable and profitable enterprise [1].
Following the purported shutdown of GandCrab in 2019, many security researchers observed the rapid emergence of REvil, also known as Sodinokibi. The similarities between the two operations were striking, including overlapping infrastructure, code similarities, and affiliate migration. REvil quickly became even more notorious, targeting high-profile organizations and critical infrastructure.
Some of the most notable REvil attacks included:
- Managed service providers (MSPs), amplifying downstream impact across multiple organizations
- Global food supplier JBS, which paid an $11 million ransom
- Software vendor Kaseya, which affected hundreds of businesses through supply-chain compromise
These incidents highlighted the evolving sophistication of ransomware operations, particularly the shift toward supply-chain attacks and double-extortion tactics, where attackers not only encrypted systems but also threatened to leak stolen data [2].
Ransomware-as-a-Service: The Business Model of Cybercrime
GandCrab and REvil exemplified the ransomware-as-a-service model, which functions similarly to legitimate software businesses. Developers maintain the malware, infrastructure, and payment systems, while affiliates conduct the attacks.
This division of labor allows:
- Rapid scaling of operations
- Geographic distribution of attackers
- Reduced operational risk for leadership
- Increased specialization within criminal networks
Affiliates typically received 60–70% of ransom payments, while operators retained the remainder. Payment portals, negotiation teams, and leak sites became standard features, transforming ransomware into a structured and professionalized criminal industry.
The model proved highly resilient, with new groups often forming from the remnants of dismantled operations. This is one reason law enforcement agencies emphasize identifying leadership figures like “UNKN,” as dismantling infrastructure alone often leads to rebranding rather than elimination.
Challenges in Enforcement
Despite the identification of Shchukin, enforcement remains complex. Russia has historically been reluctant to extradite cybercrime suspects, particularly when victims are primarily located outside its borders. As a result, individuals identified by Western law enforcement often remain beyond immediate reach.
However, public attribution still carries meaningful consequences:
- International arrest warrants limit travel
- Financial sanctions can disrupt operations
- Infrastructure seizures become easier
- Affiliates may distance themselves from identified leaders
These measures can significantly disrupt ransomware ecosystems, even without immediate arrest.
A Broader Shift in Cybercrime Attribution
The naming of “UNKN” reflects a broader shift in how governments approach cybercrime. Rather than focusing solely on infrastructure takedowns, authorities are increasingly targeting individuals behind operations.
This strategy mirrors efforts seen in:
- Dark web marketplace takedowns
- Nation-state attribution campaigns
- Cryptocurrency tracing and seizure operations
- Joint international law enforcement task forces
Improved blockchain analytics, intelligence sharing, and digital forensics have made attribution more feasible than in earlier years.
What This Means for Organizations
While the unmasking of a major ransomware figure is encouraging, it does not eliminate the threat. Organizations should continue prioritizing defenses such as:
- Regular patch management
- Network segmentation
- Multi-factor authentication
- Offline backups
- Vendor and supply chain risk monitoring
- Incident response planning
Ransomware groups continue to evolve, and new variants regularly emerge to replace dismantled operations.
Looking Ahead
The identification of Daniil Maksimovich Shchukin marks a significant milestone in international cybersecurity enforcement. It demonstrates that even sophisticated cybercriminals operating behind layers of anonymity can eventually be identified through persistent investigative work.
However, the broader ransomware ecosystem remains active and adaptive. While this development disrupts one major node in the cybercrime landscape, the fight against ransomware will continue to require coordinated global efforts, improved defensive practices, and ongoing intelligence sharing.
For cybersecurity professionals and organizations alike, this case serves as both a warning and a reminder: anonymity in cybercrime is becoming harder to maintain, but the threat itself is far from disappearing.
Sources
- [1] Germany Doxes “UNKN,” Head of RU Ransomware Gangs REvil, GandCrab (krebsonsecurity.com)
- [2] German authorities identify REvil and GangCrab ransomware bosses (www.bleepingcomputer.com)
StealthAnon is a news and analysis site covering cybersecurity, privacy, web analytics, anonymity, and tech tools.
