German Authorities Unmask Leaders Behind REvil and GandCrab Ransomware Attacks
Executive Summary
In April 2026, Germany's Federal Criminal Police Office (BKA) identified Russian nationals Daniil Maksimovich Shchukin and Anatoly Sergeevitsch Kravchuk as the leaders of the GandCrab and REvil ransomware operations between 2019 and 2021. Operating under aliases such as 'UNKN' or 'UNKNOWN,' Shchukin and Kravchuk orchestrated at least 130 cyberattacks targeting German companies, resulting in over $40 million in damages and approximately $2.2 million in ransom payments. Their operations popularized the 'double extortion' tactic, demanding payment for decrypting data and additional sums to prevent public release of stolen information. (bleepingcomputer.com)
This identification underscores the persistent threat posed by sophisticated ransomware groups and highlights the importance of international cooperation in combating cybercrime. The GandCrab and REvil models have influenced current ransomware tactics, emphasizing the need for robust cybersecurity measures and proactive threat intelligence to mitigate such risks.
Why This Matters Now
The identification of Shchukin and Kravchuk highlights the ongoing evolution of ransomware tactics and the necessity for organizations to enhance their cybersecurity defenses against increasingly sophisticated threats.
Attack Path Analysis
The attackers initiated the attack by exploiting vulnerabilities in public-facing applications to gain initial access. They then escalated privileges by exploiting misconfigured identity and access management (IAM) policies. Utilizing these elevated privileges, they moved laterally across the network to identify and access critical systems. The attackers established command and control channels to maintain persistent access and control over the compromised environment. They exfiltrated sensitive data by transferring it to external servers under their control. Finally, they encrypted critical data and systems to disrupt operations and extort ransom payments.
Kill Chain Progression
Initial Compromise
Description
The attackers exploited vulnerabilities in public-facing applications to gain initial access to the network.
MITRE ATT&CK® Techniques
Phishing
Valid Accounts
Data Encrypted for Impact
Inhibit System Recovery
Command and Scripting Interpreter
Obfuscated Files or Information
Exfiltration Over C2 Channel
Application Layer Protocol
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Malicious Software Prevention
Control ID: 6.4.3
NYDFS 23 NYCRR 500 – Encryption of Nonpublic Information
Control ID: 500.15
DORA – ICT Risk Management Framework
Control ID: Article 10
CISA ZTMM 2.0 – Identity and Access Management
Control ID: 3.1
NIS2 Directive – Incident Handling
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Financial Services
REvil ransomware targeted financial institutions with data exfiltration and encryption attacks, requiring enhanced egress security and zero trust segmentation controls.
Government Administration
Multiple Texas local governments fell victim to REvil attacks, highlighting critical need for multicloud visibility and threat detection capabilities.
Information Technology/IT
Kaseya supply-chain attack impacted 1,500 downstream businesses, demonstrating vulnerability of IT service providers to ransomware lateral movement techniques.
Health Care / Life Sciences
Healthcare sector faces high ransomware risk with HIPAA compliance requirements necessitating encrypted traffic protection and comprehensive anomaly detection systems.
Sources
- German authorities identify REvil and GandCrab ransomware bosseshttps://www.bleepingcomputer.com/news/security/german-authorities-identify-revil-and-gangcrab-ransomware-bosses/Verified
- BKA Identifies REvil Leaders Behind 130 German Ransomware Attackshttps://thehackernews.com/2026/04/bka-identifies-revil-leaders-behind-130.htmlVerified
- German authorities identify alleged leader of GandCrab and REvil ransomware gangshttps://www.scworld.com/brief/german-authorities-identify-alleged-leader-of-gandcrab-and-revil-ransomware-gangsVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF is pertinent to this incident as it could have limited the attacker's ability to move laterally and exfiltrate data by enforcing strict segmentation and identity-aware policies.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: The attacker's initial access may have been constrained by limiting exposure of public-facing applications through embedded security controls.
Control: Zero Trust Segmentation
Mitigation: The attacker's ability to escalate privileges could have been limited by enforcing strict identity-aware access controls.
Control: East-West Traffic Security
Mitigation: The attacker's lateral movement would likely have been constrained by segmenting east-west traffic and enforcing strict access controls.
Control: Multicloud Visibility & Control
Mitigation: The attacker's command and control channels may have been disrupted by providing comprehensive visibility and control over network traffic.
Control: Egress Security & Policy Enforcement
Mitigation: The attacker's data exfiltration efforts would likely have been constrained by enforcing strict egress policies and monitoring outbound traffic.
The attacker's ability to encrypt critical data and systems may have been limited by restricting unauthorized access and segmenting critical assets.
Impact at a Glance
Affected Business Functions
- Data Management
- IT Operations
- Customer Service
- Financial Transactions
Estimated downtime: 14 days
Estimated loss: $40,000,000
Confidential business data, customer information, and financial records
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation to enforce least privilege access and limit lateral movement.
- • Deploy East-West Traffic Security controls to monitor and restrict internal traffic flows.
- • Utilize Egress Security & Policy Enforcement to control outbound traffic and prevent data exfiltration.
- • Establish Multicloud Visibility & Control to detect and respond to anomalous activities across cloud environments.
- • Apply Inline IPS (Suricata) to identify and block known exploit patterns and malicious payloads.
