[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fCAMxTunBNQ7ovrk3L8YuiHFCL8p-LenzmJ13RyI1WcM":3},{"article":4,"iocs":46,"watch_terms":55},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":28,"category":29,"article_tags":33},"c69a3eed-53b8-4dd8-beb1-5d749b159d55","German Police Unmask REvil Ransomware Leader","german-police-unmask-revil-ransomware-leader","Shchukin is accused of extorting more than $2 million as the head of the GandCrab and REvil ransomware operations. The post German Police Unmask REvil Ransomware Leader appeared first on SecurityWeek.","German Federal Criminal Police (BKA) publicly named Daniil Maksimovich Shchukin, 31, a Russian national, as the mastermind behind the GandCrab and REvil ransomware operations that ran from early 2019 to mid-2021. Shchukin allegedly orchestrated 130 extortion attempts causing over $40 million in damages, with victims paying more than $2 million in ransoms. Law enforcement has linked him to co-conspirator Anatoly Sergeevitsch Kravchuk and notes Shchukin likely remains in Russia.","German police identify Russian national as REvil\u002FGandCrab ransomware leader.","The German Federal Criminal Police (BKA) has named a Russian national as the mastermind behind the GandCrab and REvil ransomware operations. According to a law enforcement notice, the man, Daniil Maksimovich Shchukin, 31, of Krasnodarskiy, Russia, led the two ransomware operations between early 2019 and mid-2021. Shchukin, the BKA says, was involved in 130 extortion attempts, including 25 in which the victims paid a total of over $2 million in ransoms. The activities are estimated to have caused over $40 million in damages. Shchukin and his co-conspirators, one of whom was identified as Russian national Anatoly Sergeevitsch Kravchuk, 43, targeted both enterprises and public institutions, the BKA says. Operating as a ransomware-as-a-service (RaaS), GandCrab emerged in early 2018 and closed shop in mid-2019, when its operators boasted about making over $150 million per year from the operation. REvil (aka Sodinokibi) emerged around the same time as GandCrab was retiring and was immediately labeled as its successor. In late 2021, law enforcement seized REvil’s servers, and seven individuals associated with the two ransomware operations were arrested.Advertisement. Scroll to continue reading. In January 2022, the Russian authorities announced the arrest of multiple individuals allegedly associated with REvil. In 2024, four members of the group were sentenced to prison. According to BKA’s notice, Shchukin is likely residing in Russia. Also known as Oneiilk2, Oneillk2, Oneillk22, UNKN, and GandCrab, he was outed in the past as the leader of REvil. In 2023, he was mentioned in a DoJ complaint for the seizure of cryptocurrency illegally obtained as part of the REvil operation, as well as in a conference talk in Germany, investigative journalist Brian Krebs points out. Related: Russian Cybercriminal Gets 2-Year Prison Sentence in US Related: US Prisons Russian Access Broker for Aiding Ransomware Attacks Related: Russian Ransomware Operator Pleads Guilty in US Related: Chilean Carding Shop Operator Extradited to US Written By Ionut Arghire Ionut Arghire is an international correspondent for SecurityWeek. More from Ionut Arghire TrueConf Zero-Day Exploited in Asian Government AttacksCritical ShareFile Flaws Lead to Unauthenticated RCEReact2Shell Exploited in Large-Scale Credential Harvesting CampaignNorth Korean Hackers Drain $285 Million From Drift in 10 SecondsCisco Patches Critical and High-Severity Vulnerabilities250,000 Affected by Data Breach at Nacogdoches Memorial HospitalMercor Hit by LiteLLM Supply Chain AttackSophisticated CrystalX RAT Emerges Latest News Medusa Ransomware Fast to Exploit Vulnerabilities, Breached SystemsWhite House Seeks to Slash CISA Funding by $707 MillionWynn Resorts Says 21,000 Employees Affected by ShinyHunters HackGoogle DeepMind Researchers Map Web Attacks Against AI AgentsGuardarian Users Targeted With Malicious Strapi NPM PackagesNorth Korean Hackers Target High-Profile Node.js MaintainersFortinet Rushes Emergency Fixes for Exploited Zero-DayEuropean Commission Confirms Data Breach Linked to Trivy Supply Chain Attack Trending Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: Securing Fragile OT in an Exposed World March 10, 2026 Get a candid look at the current OT threat landscape as we move past \"doom and gloom\" to discuss the mechanics of modern OT exposure. Register Webinar: Why Automated Pentesting Alone Is Not Enough April 7, 2026 Join our live diagnostic session to expose hidden coverage gaps and shift from flawed tool-level evaluations to a comprehensive, program-level validation discipline. Register People on the MoveScott Goree has been appointed Senior Vice President of Channel and Alliances at Delinea.Kai has named Nick Degnan as Chief Revenue Officer.Joe Sullivan has been appointed Strategic Advisor at cloud security firm Upwind.More People On The MoveExpert Insights The Next Cybersecurity Crisis Isn’t Breaches—It’s Data You Can’t Trust Data integrity shouldn’t be seen only through the prism of a technical concern but also as a leadership issue. (Steve Durbin) Why Agentic AI Systems Need Better Governance – Lessons from OpenClaw Agentic AI platforms are shifting from passive recommendation tools to autonomous action-takers with real system access, (Etay Maor) The Human IOC: Why Security Professionals Struggle with Social Vetting Applying SOC-level rigor to the rumors, politics, and 'human intel' can make or break a security team. (Joshua Goldfarb) How to 10x Your Vulnerability Management Program in the Agentic Era The evolution of vulnerability management in the agentic era is characterized by continuous telemetry, contextual prioritization and the ultimate goal of agentic remediation. (Nadir Izrael) SIM Swaps Expose a Critical Flaw in Identity Security SIM swap attacks exploit misplaced trust in phone numbers and human processes to bypass authentication controls and seize high-value accounts. (Torsten George) Flipboard Reddit Whatsapp Whatsapp Email","https:\u002F\u002Fwww.securityweek.com\u002Fgerman-police-unmask-revil-ransomware-leader\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2024\u002F08\u002Fhacker-unmasked.jpeg","2026-04-07T09:24:40+00:00","2026-04-07T10:00:55.995169+00:00",8,[18,21,23,26],{"name":19,"type":20},"Daniil Maksimovich Shchukin","threat_actor",{"name":22,"type":20},"Anatoly Sergeevitsch Kravchuk",{"name":24,"type":25},"REvil","campaign",{"name":27,"type":25},"GandCrab","7d8b5ab8-ea0b-4ced-ae97-ec251b86993a",{"id":28,"icon":30,"name":31,"slug":32},null,"Ransomware","ransomware",[34,39,41],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":40},{"id":28,"icon":30,"name":31,"slug":32},{"category":42},{"id":43,"icon":30,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[47,50,52],{"type":48,"value":24,"context":49},"malware","Ransomware-as-a-service operation led by Shchukin (2019–2021)",{"type":48,"value":27,"context":51},"Predecessor ransomware operation led by Shchukin (early 2018–mid-2019)",{"type":48,"value":53,"context":54},"Sodinokibi","Alternative name for REvil ransomware",[]]