Germany Doxes “UNKN,” Head of RU Ransomware Gangs REvil, GandCrab
Daniil Maksimovich Shchukin, a 31-year-old Russian national, is the man hiding behind the legendary pseudonym "UNKN," who for years led the most dangerous ransomware groups in history: GandCrab and REvil. The German Federal Criminal Police Office (BKA) has officially identified the cybercrime leader, attributing to him direct responsibility for at least 130 acts of computer sabotage and extortion carried out between 2019 and 2021. Shchukin, acting alongside 43-year-old Anatoly Kravchuk, extorted nearly 2 million euros, though the actual economic losses caused by their activities are estimated at over 35 million euros. For the global technology community and corporate users, the deanonymization of "UNKN" represents a breakthrough moment in the fight against the Ransomware-as-a-Service (RaaS) model. REvil became notorious for its highly aggressive attacks on critical infrastructure and global supply chains, paralyzing thousands of companies worldwide. The disclosure of key players' identities sends a clear signal: digital anonymity on the darknet is illusory, and law enforcement agencies possess increasingly effective tools for tracking cryptocurrency flows and correlating digital footprints. This serves as a stark warning to REvil's successors that every line of malicious code ultimately leads to a specific name and criminal liability.
For years, the cybersecurity industry treated the figure hiding under the pseudonym UNKN (also known as UNKNOWN) as an almost mythical architect of digital chaos. As the leader of infamous Russian ransomware groups such as GandCrab and REvil, UNKN was behind audacious attacks that paralyzed global corporations and public institutions. Today, that anonymity has crumbled. German investigative services have made a breakthrough, publicly unmasking the man behind these operations. He is no longer just an anonymous user of dark forums, but a specific person with a name, surname, and a history, who has just become a target of international justice.
The German Federal Criminal Police Office (Bundeskriminalamt, abbreviated as BKA) has officially announced that the person behind the pseudonym UNKN is a 31-year-old Russian, Daniil Maksimovich Shchukin. He is alleged to have led both criminal groups, which revolutionized the cybercrime business model by introducing the Ransomware-as-a-Service (RaaS) scheme. Thanks to this model, groups like REvil not only attacked targets themselves but also shared their malicious software with partners in exchange for a percentage of the extorted ransoms, leading to an unprecedented scale of infections worldwide.
The architect of digital extortion and his accomplice
The investigation led by the BKA sheds light on the scale of activities of Shchukin and his closest associates. Alongside the leader, 43-year-old Anatoly Sergeevitsch Kravchuk was also named. According to the investigators' findings, this duo played a key role in carrying out at least 130 acts of computer sabotage and extortion in the period between 2019 and 2021 alone. Although their activities were global in nature, German services focused on documenting the losses suffered by entities operating on their territory, which allowed for specific charges to be brought and arrest warrants to be issued.
The BKA operation also demonstrates the evolution of investigative methods. Tracking down UNKN required complex analysis of cryptocurrency flows, monitoring metadata left in malware code, and painstaking intelligence work within closed cybercriminal communities. The fact that German services decided on such an open communication suggests they possess irrefutable evidence linking Shchukin to specific attacks, which is a rare achievement in a digital world full of red herrings and proxy servers.
It is worth noting the technical specifications of the activities of the GandCrab and REvil groups, which under Shchukin's leadership utilized, among others:
- Exploit kits to automatically infect users browsing compromised websites.
- Supply chain attacks, the most high-profile example being the attack on the company Kaseya.
- Advanced code obfuscation techniques, which for a long time allowed them to bypass traditional antivirus systems.
- Utilization of the RDP (Remote Desktop Protocol) to take control of corporate servers.
The end of the era of impunity in Russia's shadow?
Although Daniil Maksimovich Shchukin is likely residing in the territory of the Russian Federation, which makes his physical detention difficult, his "wanted by Interpol" status drastically changes his situation. History shows that cybercriminals of this rank often get caught while vacationing in countries that maintain extradition treaties with the West or become bargaining chips in larger geopolitical games. For Pixelift and observers of the AI and creative technology sectors, this case is a reminder that behind the most advanced data-destroying algorithms are people who can be identified.
The unmasking of UNKN is a signal to the entire industry: the time of absolute anonymity on the web is coming to an end. Even the most sophisticated methods of hiding identity, from cryptocurrency mixers to multi-layered VPNs, leave traces that, with sufficient determination from authorities and international cooperation, create a complete picture of the perpetrator. Shchukin, who for years built an empire based on fear and digital extortion, has now become a symbol of the effectiveness of modern digital forensics. His case defines a new reality in which a digital footprint becomes a digital sentence, regardless of how deep in the web a given criminal tries to hide.