Germany Doxes UNKN - Leader of REvil and GandCrab Gangs
Basically, a hacker named UNKN has been identified as the leader of two major ransomware groups.
German authorities have identified Daniil Shchukin, the mastermind behind the notorious REvil and GandCrab ransomware gangs. His actions have caused significant economic damage across Germany, highlighting the ongoing threat of cybercrime. As investigations continue, organizations must enhance their cybersecurity measures.
The Threat
In a significant breakthrough, German authorities have unveiled the identity of a notorious hacker known as UNKN. This individual, Daniil Maksimovich Shchukin, is linked to the infamous REvil and GandCrab ransomware groups. These gangs have been responsible for over 130 acts of computer sabotage and extortion across Germany from 2019 to 2021.
Who's Behind It
Shchukin, a 31-year-old Russian, is believed to have led these cybercrime organizations that pioneered the practice of double extortion. This tactic involved charging victims for a key to unlock their hacked systems and demanding additional payment to prevent the publication of stolen data. Alongside Shchukin, another Russian, Anatoly Sergeevitsch Kravchuk, was also implicated, with the two extorting nearly €2 million across multiple cyberattacks.
Tactics & Techniques
The GandCrab ransomware affiliate program emerged in January 2018, allowing hackers to profit significantly from their attacks. Shchukin's group claimed to have extorted over $2 billion from victims before announcing its shutdown in May 2019. Following this, REvil surfaced, with Shchukin at the helm, continuing the legacy of sophisticated ransomware operations. The group targeted large organizations, leveraging cyber insurance policies to maximize extortion payouts.
Defensive Measures
The German Federal Criminal Police (BKA) has taken steps to notify the public about Shchukin's identity and his criminal activities. They have also linked him to various cryptocurrency accounts containing over $317,000 in illicit funds. The BKA's advisory serves as a warning to potential victims and highlights the ongoing threat posed by ransomware gangs.
What to Watch
As investigations continue, authorities are focusing on Shchukin's whereabouts, with indications that he may still be in Russia. The BKA's findings underscore the evolving landscape of ransomware, where groups like REvil and GandCrab have set a dangerous precedent for cyber extortion. Cybersecurity experts recommend organizations bolster their defenses and remain vigilant against such threats, especially as ransomware tactics become increasingly sophisticated.