Germany Identifies Leaders of GandCrab and REvil Ransomware

German authorities have identified two Russian nationals as key figures behind the notorious GandCrab and REvil ransomware operations, which targeted businesses and institutions worldwide from 2018 to 2021. The Federal Criminal Police Office, known as the BKA, issued international arrest warrants for Daniil Maksimovich Shchukin, a 31-year-old from Krasnodar, and Anatoly Sergeevich Kravchuk, a 43-year-old Ukraine-born Russian, accusing them of leading and developing the groups.

According to the BKA, Shchukin, who operated under the alias UNKN or UNKNOWN, served as a central leader, promoting the ransomware on cybercrime forums and coordinating attacks. Kravchuk is alleged to have developed the malicious software. The suspects are linked to at least 130 ransomware incidents in Germany between 2019 and 2021, including about two dozen that resulted in nearly 2 million euros in extorted payments and more than 35 million euros in economic damage to victims, such as businesses and public organizations.

The GandCrab operation emerged in early 2018 as a ransomware-as-a-service model, where developers created encryption tools and affiliates deployed them for a share of profits. It spread...