Skip to content
German Authorities Identify Leaders of REvil and GandCrab Ransomware Gangs

German Authorities Identify Leaders of REvil and GandCrab Ransomware Gangs

First seen 6 Apr 2026, 10:43 UTC

Article Content

Browse articles
ThreatCluster AI
ThreatCluster April 7, 2026 at 10:32 UTC
  • Daniil Shchukin and Anatoly Kravchuk identified as leaders of REvil and GandCrab gangs.
  • The gangs executed at least 130 cyberattacks in Germany, causing over €35 million in damages.
  • Shchukin is known for pioneering the double extortion tactic in ransomware operations.

German Federal Criminal Police (BKA) have identified Daniil Maksimovich Shchukin, 31, and Anatoly Sergeevitsch Kravchuk, 43, as the leaders of the notorious REvil and GandCrab ransomware gangs. Shchukin, known by the alias 'UNKN,' is linked to at least 130 cyberattacks in Germany from 2019 to 2021, resulting in approximately €2 million in ransom payments and over €35 million in economic damage. Both gangs were known for pioneering the double extortion tactic, demanding payments for decryption keys and to prevent data leaks. The BKA has issued a public appeal for information regarding their whereabouts, as both suspects are believed to be in Russia. This identification marks a significant milestone in the ongoing efforts to combat ransomware operations that have plagued organizations globally. The REvil gang, in particular, gained notoriety for targeting large enterprises and conducting high-profile attacks, including the Kaseya incident that affected around 1,500 downstream victims.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 157d ago How this analysis works

Timeline

2018-01-01
GandCrab ransomware operation launched.
2019-06-01
GandCrab leader retires after claiming $2 billion earnings.
2021-07-01
REvil gang conducts Kaseya attack affecting 1,500 victims.
2026-04-06
German authorities publicly identify Shchukin and Kravchuk.

More articles in this cluster (19)

Following this threat?

Track GandCrab, Sodinokibi and Acer in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed