German Federal Police (BKA) has identified two Russian citizens as key figures in the GandCrab and REvil ransomware activities that occurred between 2019 and 2021.

The BKA revealed that Daniil Maksimovich Shchukin, aged 31, and Anatoly Sergeevitsch Kravchuk, aged 43, were the leaders of these two ransomware groups from at least the start of 2019 until at least July 2021.

Shchukin, known by the aliases UNKN/UNKNOWN, was active on cybercrime forums for years and acted as a spokesperson for the ransomware operation.

German authorities assert that Shchukin and Kravchuk were involved in at least 130 cases of extortion specifically aimed at German companies.

As a result of these attacks, at least 25 victims paid Shchukin and his accomplices $2.2 million in ransom, while the total financial impact is estimated to be over $40 million.

GandCrab emerged in early 2018, and its director decided to end operations in June 2019, claiming to have made $2 billion from ransom payments. The leader allegedly took $150 million from this amount and invested it in legitimate businesses.

Soon after, REvil appeared, using the affiliate model GandCrab established by advertising and creating partnerships with cybercriminals.

REvil, also called Sodinokibi, was formed by former GandCrab affiliates and operators experienced in successful tactics, which they then implemented in their operations.

REvil later introduced public leak sites and held data auctions to pressure victims. High-profile victims include several Texas local governments, computer company Acer, and the Kaseya attack that affected around 1,500 other victims.

Following the major Kaseya intrusion, REvil paused operations for two months. During this time, law enforcement infiltrated their servers and started monitoring them.

Several infrastructure problems occurred then, and in mid-January 2022, Russia apprehended over a dozen REvil members, who were released in 2025 after serving time for carding crimes.

It’s unknown if Shchukin or Kravchuk joined other ransomware gangs after REvil ceased operations in 2021.

The BKA believes Shchukin and Kravchuk are currently in Russia and is asking the public for any information that could help locate them. They have also been added to the EU’s Most Wanted list.

The police have released several images, including photos of their tattoos, to assist in finding and prosecuting these two threat actors.