German Authorities Unmask Leader of Major Ransomware Groups

German federal authorities have identified Daniil Maksimovich Shchukin as the leader of the notorious ransomware operations GandCrab and REvil, according to an advisory from the German Federal Criminal Police (BKA). The 31-year-old Russian national, who operated under the alias “UNKN,” is alleged to have orchestrated at least 130 cyberattacks between 2019 and 2021, causing over 35 million euros in economic damage.

Double Extortion Tactics and Global Reach

Shchukin allegedly headed one of the largest ransomware groups globally, pioneering the practice of “double extortion.” This method involves charging victims for both unlocking systems and preventing the public release of stolen data. The BKA highlighted that Shchukin and another Russian national, Anatoly Sergeevitsch Kravchuk, extorted nearly 2 million euros across 24 cyberattacks.

Evidence and Legal Actions

The U.S. Justice Department referenced Shchukin in a February 2023 filing seeking the seizure of cryptocurrency accounts linked to REvil ransomware activities. The filing noted that a digital wallet tied to Shchukin contained over $317,000 in illicitly obtained cryptocurrency. The BKA has issued a warning that Shchukin may be abroad, potentially in Russia, though his exact location remains unknown.

Ransomware Evolution: From GandCrab to REvil

GandCrab, which emerged in 2018, operated as an affiliate program, offering hackers significant profits for breaching corporate systems. The group reportedly extorted over $2 billion before its shutdown in 2019. REvil