- Germany’s Federal Police (BKA) fished out two Russians as the masterminds behind REvil and GandCrab ransomware operations of the past decade.
- The two suspects led at least 130 extortion attacks against German companies from 2019 to 2021, pulling in over $2.2 million in ransoms from victims alone.
- BKA now believes both men are sheltering inside Russia and has listed them on the EU’s Most Wanted portal, appealing to the public for any information on their whereabouts.
Germany’s Federal Criminal Police Office (BKA) just put names and faces to two of cybercrime’s most wanted figures.
The agency has officially identified Daniil Maksimovich Shchukin, 31, and Anatoly Sergeevitsch Kravchuk, 43, as the heads of the GandCrab and REvil ransomware operations.
According to the BKA’s disclosure, both men ran these criminal enterprises “from at least the beginning of 2019 until at least July 2021” (years during which their operations terrorized companies across Europe and beyond).
BKA Links Two Russians to 130 Attacks and $40 Million in Damages
The BKA says Shchukin and Kravchuk directly participated in at least 130 extortion cases targeting German companies. Those attacks left a financial trail that investigators have spent years following.
At least 25 victims paid Shchukin and his co-conspirators $2.2 million in ransom payments. But the total damage their operations caused stretches far wider; investigators estimate the full financial impact exceeded $40 million.
Shchukin operated in the shadows for years, using the aliases UNKN and UNKNOWN across cybercrime forums. He posted updates, negotiated on behalf of the ransomware group, and built his reputation as a trusted face of the operation (all while law enforcement worked to strip away the mask).
GandCrab launched in early 2018 and quickly grew into one of the most aggressive ransomware-as-a-service platforms the criminal underground had ever seen.
Its anonymous leader ran the operation until June 2019, when they announced retirement, claiming the group had raked in $2 billion from ransom payments over its lifespan.
The leader personally walked away with $150 million, which they claimed to have moved into legitimate businesses.
REvil Picked Up Where GandCrab Left Off then Went Further
GandCrab’s retirement did not slow anything down. Shortly after its closure, a new operation called REvil; also known as Sodinokibi, stepped in and inherited the playbook. Former GandCrab affiliates and operators built REvil using the same affiliate model their predecessor had perfected, quickly scaling it into an even more aggressive criminal enterprise.
REvil pushed boundaries GandCrab had never crossed. The group launched public data leak sites and ran open auctions on stolen files, using the threat of public exposure to squeeze payments out of victims who refused to cooperate quietly.
The group’s target list grew to include multiple Texas local governments, computer giant Acer, and most notoriously, the Kaseya supply-chain attack, which rippled outward and hit approximately 1,500 downstream victims in a single strike.
The Kaseya attack triggered a two-month operational pause. During that window, law enforcement quietly breached REvil’s servers and began monitoring the group’s internal communications and movements.
Multiple infrastructure disruptions followed. In mid-January 2022, Russian authorities arrested more than a dozen REvil members. Those individuals served time on carding charges and walked free in 2025.
Suspects Believed to be Inside Russia as Europe Issues Most Wanted Alert
The BKA believes Shchukin and Kravchuk are currently in Russia. Neither has faced arrest, and investigators have not confirmed whether either man joined another ransomware operation after REvil collapsed in 2021. That uncertainty makes the public appeal critical.
German authorities have created active profiles for both suspects on the EU’s Most Wanted portal. The BKA also released several identifying photographs including tattoo images to help the public recognize and report either individual.
Anyone holding information about Shchukin or Kravchuk’s current location is urged to contact German federal authorities immediately. The scale of what these two men allegedly built, hundreds of victims, tens of millions in damages, and years of evasion, makes bringing them to justice one of Europe’s most pressing cybercrime priorities.
The urgency is underscored by ongoing threats like the recent Russian hacker alliance attack on Denmark, proving that Russian-speaking cybercriminals remain a persistent danger to European nations, whether operating as ransomware kingpins or as part of state-aligned hacking campaigns.
