Threats · 161 days ago
German authorities have publicly identified the elusive ransomware leader known as 'UNKN' as 31-year-old Daniil Maksimovich Shchukin. This attribution connects a real individual to the leadership of the notorious GandCrab and REvil ransomware groups, responsible for at least 130 extortion acts causing over €35 million in economic damage. Shchukin's identity was corroborated by details including his age, name, and co-conspirator, and aligns with a February 2023 U.S. Justice Department filing that sought seizure of cryptocurrency linked to REvil's proceeds.
This public doxing transforms an opaque online alias into a concrete investigatory target, enabling law enforcement to focus asset seizures, prosecutions, and victim attribution efforts. For most defenders, this development does not require immediate technical action but signals enhanced prospects for legal and intelligence operations against ransomware leadership. It may also prompt short-term operational shifts among related threat
5 sources covering this story
German Police Unmask REvil Ransomware Leader
Shchukin is accused of extorting more than $2 million as the head of the GandCrab and REvil ransomware operations.
German authorities identify REvil and GandCrab ransomware bosses
The Federal Police in Germany (BKA) has identified two Russian nationals as the leaders of GandCrab and REvil ransomware operations between 2019 and 2021.
The Record from Recorded Future
German police unmask two suspects linked to REvil ransomware gang
The suspects were named as Daniil Shchukin, a 31-year-old Russian national believed to have used the alias UNKN (UNKNOWN), and Anatoly Kravchuk, a 43-year-old Ukraine-born Russian citizen who investigators say worked as a developer for the group.
BKA Identifies REvil Leaders Behind 130 German Ransomware Attacks
BKA identified REvil leaders tied to 130 German attacks causing €35.4M damage, exposing key ransomware figures.
Germany Doxes “UNKN,” Head of RU Ransomware Gangs REvil, GandCrab
An elusive hacker who went by the handle "UNKN" and ran the early Russian ransomware groups GandCrab and REvil now has a name and a face.
Part of the PlainSec briefing for 2026-04-06