The German police (BKA) have identified the person behind the major players in the defunct REvil ransomware operation (also known as Sodinokibi), which was a ransomware-as-a-service (RaaS) business.

The individual, known as UNKN, acted as a representative of the group, promoting the ransomware on the XSS cybercrime forum in June 2019. He is now identified as Daniil Maksimovich Shchukin, a 31-year-old from Russia. He also used the online names Oneiilk2, Oneillk2, Oneillk22, and GandCrab.

The news was reported by security journalist Brian Krebs.

“From early 2019 until at least July 2021, the wanted person, with others, was the leader of a large ransomware group, GandCrab/REvil,” the BKA stated. “The criminals demanded large payments to decrypt and not release data.”

Also on the wanted list is Anatoly Sergeevitsch Kravchuk, 43, a Russian born in Makiivka, Ukraine. He allegedly developed REvil during the same period.

Shchukin and Kravchuk are suspected of performing 130 ransomware attacks in Germany. 25 cases resulted in payments of €1.9 million ($2.19 million). The total damage from these incidents is over €35.4 million ($40.8 million).

REvil (also Water Mare and Gold Southfield) was a major ransomware group that targeted companies like JBS and Kaseya. It was an advancement of the GandCrab ransomware, and the group disappeared in July 2021, only to return two months later.

By October 2021, the group stopped operating, and its data leak site was shut down as part of a law enforcement effort. Later, Romanian police announced the arrests of two people for being REvil ransomware affiliates.

In a rare case, Russia’s FSB announced in January 2022 that it had arrested members of the REvil ransomware gang and stopped their activities. Four of them were sentenced to prison in October 2024, according to Kommersant reports.

UNKN also disappeared from cybercrime forums at the time, and another user, REvil (later renamed 0_neday), became the public face of the gang.

In an interview with Dmitry Smilyanets of Recorded Future in March 2021, UNKN said he had been in the ransomware business since 2007 and that at one point the group had 60 affiliates.

“As a child, I searched trash and smoked cigarette ends. I walked 10 km to school,” he said. “I wore the same clothes for six months. In my youth, in a shared apartment, I didn’t eat for two or three days. Now I am a millionaire.”