German authorities want your help finding the hackers behind GandCrab and REvil
Daniil Maksimovich Shchukin and Anatoly Sergeevitsch Kravchuk are believed to have made millions from ransomware as a service schemes
German police have identified two Russian hackers and are calling for help tracking them down.
The German Federal Criminal Police (BKA) said that 31-year-old Daniil Maksimovich Shchukin, who went by the handle 'UNKN', was behind the Russian ransomware groups GandCrab and REvil.
He is suspected of having carried out 130 incidents of gang-related extortion against German organizations, along with 43-year-old Anatoly Sergeevitsch Kravchuk, a Ukraine-born Russian citizen.
Kravchuk is accused of creating and further developing the dark web site used by the group to organize and manage extortion, as well as development of the malware itself.
Across 25 of the cases, the BKA said a total of €35.4 million was paid out in ransom payments.
"Based on investigations conducted so far, the wanted person is believed to be currently abroad, presumably in Russia. It is impossible to rule out potential travel," the BKA said.
"The police are interested in receiving a response to the following question: can you provide any information on the wanted person's current whereabouts?"
Sign up today and you will receive a free copy of our Future Focus 2026 report - the leading resource for IT decision-maker insight on priorities and investment areas in AI, security and more.
REvil mastermind
From the beginning of 2019 until at least July 2021, Shchukin acted as the head of one of the largest ransomware groups globally, known as GandCrab or, later, REvil.
"For the decryption and non-publication of data, the perpetrators demanded high ransoms," said the BKA. "In addition, in some cases, extensive data were also spied on and threatened with the publication of this, unless a ransom was paid."
GandCrab operated a ransomware as a service (RaaS) model, primarily through the use of spam emails. It's believed to have netted a total of more than $2 billion from ransomware attacks, before evolving into REvil, also known as Sodinokibi, in 2019.
“We are a living proof that you can do evil and get off scot-free,” GandCrab said as it bowed out. “We have proved that one can make a lifetime of money in one year. We have proved that you can become number one by general admission, not in your own conceit.”
The group claimed to have been making $2.5 million per week.
"We personally earned more than 150 million dollars per year," Shchukin claimed. "We successfully cashed in this money and legalized it in various spheres of white business both in real life and on the internet."
In its next incarnation as REvil, the group targeted large organizations including IT management software firm Kaseya in a 2021 supply chain attack that saw as many as 1,500 organizations compromised.
Law enforcement agencies including the FBI were eventually able to infiltrate the group’s infrastructure and get hold of its decryption keys, which were then distributed to victims.
The US Justice Department also seized cryptocurrency worth more than $317,000 linked to wallets allegedly controlled by Shchukin.
FOLLOW US ON SOCIAL MEDIA
Follow ITPro on Google News and add us as a preferred source to keep tabs on all our latest news, analysis, views, and reviews.
You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.
Emma Woollacott is a freelance journalist writing for publications including the BBC, Private Eye, Forbes, Raconteur and specialist technology titles.
-
What is AI insurance?In-depth The introduction of any new technology brings new risks, and AI's rapid expansion into the workplace is no exception. In response, a distinct category of insurance coverage has emerged
-
The CISO now owns physical security. Here’s what that means for the channelIndustry Insights Physical security budgets have moved to CISOs, and partners must adapt to this important shift
-
Companies are still paying ransoms to cyber criminals despite official adviceNews A Proofpoint survey found evolving ransomware techniques and the use of AI is exacerbating the situation for victims
-
This one cyber crime group accounted for nearly a fifth of all ransomware attacks in JuneNews The Gentlemen, a ransomware a service operator, now accounts for 17% of published attacks
-
Working with the enemy: Ransomware negotiator-turned cyber criminal jailed after working with hackers to extort clientsNews Angelo Martino was supposed to be negotiating on behalf of victims, but was secretly working for ransomware operators
-
‘The risk to every organization has increased exponentially’: The FortiBleed campaign just took a turn for the worseNews Reports suggest that FortiBleed-linked exposed credentials could put UK government and public services at huge risk
-
Hackers are posing as Interpol to target small businesses – here's what you need to knowNews Small businesses are warned to think twice before clicking on links
-
‘Every hour ransomware goes undetected drastically increases its potential blast radius’: Hackers are breaching networks and laying low for longer – and nearly half of firms don’t realize until data is stolenNews An ExtraHop survey found more intrusions are going undetected, leading to longer dwell times
-
US offers $10m bounty for info on Russia-linked hackers behind Signal and WhatsApp attacksNews UNC5792 and UNC4221 have been targeting government officials through their Signal and WhatsApp accounts
-
Duo accused of role in TfL cyber attack plead guilty after ‘lengthy, highly complex, and painstaking investigation’News Around 10 million people are believed to have been affected by the TfL cyber attack