Back Technadu

Germany Identifies Suspected REvil Ransomware Leader Daniil Shchukin

Technadu • April 6, 2026

German federal authorities have officially identified the elusive cybercriminal known as UNKN (or UNKNOWN) as 31-year-old Russian national Daniil Maksimovich Shchukin. The German Federal Criminal Police (BKA) alleges that Shchukin acted as the primary architect behind the notorious REvil ransomware gang and the GandCrab ransomware affiliate program.

Working alongside 43-year-old associate Anatoly Sergeevitsch Kravchuk, Shchukin reportedly executed widespread cyber extortion campaigns targeting critical enterprise infrastructure.

The BKA investigation links the suspects to at least 130 distinct acts of computer sabotage within Germany alone. Between 2019 and 2021, these operations extorted nearly €2 million from victims and inflicted roughly €35 million in economic damage.

Shchukin's syndicates pioneered double extortion, demanding simultaneous payments for system decryption keys and data confidentiality. The GandCrab ransomware operation functioned as a highly profitable affiliate network before transitioning into the REvil structure , which infamously compromised IT management firm Kaseya in July 2021.

Furthermore, United States Justice Department filings from 2023 directly connected Daniil Maksimovich Shchukin to cryptocurrency wallets containing over $317,000 in illicit proceeds.

While Shchukin is currently believed to reside in Krasnodar, Russia , the publication of his identity and associated technical infrastructure significantly restricts his operational mobility.

Threat actors were arrested and charged for REvil Ransomware attacks in 2021, with $6 million seized. In 2024, authorities announced that a notorious Russian hacker connected to Conti and LockBit was apprehended.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

German Authorities Identify Leaders of REvil and GandCrab Ransomware Gangs German Federal Criminal Police (BKA) have identified Daniil Maksimovich Shchukin, 31, and Anatoly Sergeevitsch Kravchuk, 43, as the leaders of the notorious REvil and GandCrab ransomware gangs. Shchukin, known by the alias 'UNKN,' is linked to at least 130 cyberattacks in Germany from 2019 to 2021, resulting in approximately €2 million in ransom payments and over €35 million in economic damage. Both gangs were known for pioneering the double extortion tactic, demanding payments for decryption keys and to prevent data leaks. The BKA has issued a public appeal for information regarding their whereabouts, as both suspects are believed to be in Russia. This identification marks a significant milestone in the ongoing efforts to combat ransomware operations that have plagued organizations globally. The REvil gang, in particular, gained notoriety for targeting large enterprises and conducting high-profile attacks, including the Kaseya incident that affected around 1,500 downstream victims. 13 sources 55

Extracted Entities

Germany Identifies Suspected REvil Ransomware Leader Daniil Shchukin

The full story

Extracted Entities

Attack Types (1)

Companies (1)

Countries (3)

MITRE ATT&CK (3)

Ransomware Groups (4)