Signal
German police identify leaders of REvil and GandCrab ransomware gangs
Evidence first: scan the strongest sources, then decide whether to go deeper.
Published 2026-04-06 18:34 UTCUpdated 2026-04-07 09:24 UTC
rss
cveexploitsbreachesmalwarethreat_actorsadvisories
Source links open
Source links and full evidence are open here. Pro adds archive history, compare-over-time, alerts, exports, and workflow. Business adds Feed API integrations and team usage.
No card needed for the free brief.
Evidence trail (top sources)
top sources (3 domains)domains are deduped. counts indicate coverage, not truth.3 top sources shown
Overview
German Federal Police have unmasked two Russian nationals as the leaders behind the notorious GandCrab and REvil ransomware operations active between 2019 and 2021.
Entities
REvilGandCrabDaniil ShchukinAnatoly Kravchuk
Score total
1.32
Momentum 24h
3
Evidence documents
-
Independent publishers
-
Independent origins
-
Primary sources
-
Secondary sources
-
Source types
-
Duplicate ratio
0%
Why now
- The arrests come after investigations into ransomware operations from 2019 to 2021.
- Recent law enforcement actions demonstrate increased focus on ransomware gangs.
- Public identification of suspects raises awareness of ransomware threat actors.
Why it matters
- Disrupting ransomware leadership can significantly reduce cyber extortion threats.
- Identifying key actors aids international law enforcement collaboration.
- Highlights ongoing efforts to combat major ransomware groups active in recent years.
LLM analysis
Topic mix: lowPromo risk: lowSource quality: high
Recurring claims
- Daniil Shchukin led the GandCrab and REvil ransomware operations and extorted over $2 million.
- Anatoly Kravchuk worked as a developer for the REvil ransomware group.
How sources frame it
- SecurityWeek: neutral
- BleepingComputer: neutral
- The Record: neutral
This report consolidates multiple sources confirming the identification of REvil and GandCrab ransomware leaders by German authorities, underscoring a key development in ransomware law enforcement efforts.
All evidence
All evidence
German Police Unmask REvil Ransomware Leader
SecurityWeek · securityweek.com · 2026-04-07 09:24 UTC
German authorities identify REvil and GangCrab ransomware bosses
BleepingComputer · bleepingcomputer.com · 2026-04-06 23:54 UTC
German police unmask two suspects linked to REvil ransomware gang
Therecord · therecord.media · 2026-04-06 18:34 UTC
Show filters & breakdown
Posts loaded: 0Publishers: 3Origin domains: 3Duplicates: -
Showing 3 / 3
Top publishers (this list)
- SecurityWeek (1)
- BleepingComputer (1)
- Therecord (1)
Top origin domains (this list)
- securityweek.com (1)
- bleepingcomputer.com (1)
- therecord.media (1)