Warning: Undefined array key "find" in /var/www/wptbox/wp-content/plugins/seo-by-rank-math-pro/includes/modules/image-seo/class-image-seo-pro.php on line 433
Warning: Undefined array key "replace" in /var/www/wptbox/wp-content/plugins/seo-by-rank-math-pro/includes/modules/image-seo/class-image-seo-pro.php on line 433
Germany Identifies “UNKN” as Leader of REvil and GandCrab Ransomware Groups
German authorities have publicly identified an individual known as “UNKN” as the head of the Russian ransomware operations REvil and GandCrab. The disclosure came through a coordinated announcement from federal law enforcement on Friday, exposing the figure central to years of global cyberattacks.
Identification Details
The German Federal Criminal Police Office (BKA) named “UNKN” in connection with the REvil and GandCrab gangs, which have extorted millions from victims worldwide. REvil, also known as Sodinokibi, dominated ransomware attacks from 2019 until U.S. authorities disrupted its infrastructure in 2021. GandCrab, active from 2018 to 2019, infected hundreds of thousands of systems before its operators shuttered the operation.
Officials stated the identification resulted from international collaboration, including analysis of seized servers and cryptocurrency transactions. “UNKN” emerges as the key administrator linking both groups, according to the BKA statement released May 1, 2026.
Operational Impact
REvil claimed responsibility for high-profile breaches, including the 2021 attack on Kaseya that affected 1,500 businesses. GandCrab pioneered ransomware-as-a-service models, distributing through affiliates. The gangs demanded ransoms in bitcoin, with REvil alone collecting over $200 million before its takedown.
German investigators linked “UNKN” to command-and-control servers hosted in Russia. The doxing includes partial personal details, such as known aliases and financial trails, aimed at pressuring Russian authorities for extradition.
Cybersecurity firms tracking these groups for years now corroborate the intelligence. This fits into broader efforts against cyber threats that mimic legitimate operations to deceive victims.
Background on the Gangs
REvil operated from underground forums, offering tools to encrypt data and demand payments. Its 2021 disruption followed a U.S. indictment of key members. GandCrab, meanwhile, retired after reportedly earning $2 billion, though successors like REvil filled the void.
Germany’s move marks a shift toward public attribution of Russian cyber actors, amid stalled extradition talks. The BKA highlighted “UNKN”’s role in developing malware payloads used across both operations.
Official Statements
BKA spokesperson stated: “Identifying ‘UNKN’ disrupts the core of these ransomware networks and sends a message to operators hiding in plain sight.” U.S. officials echoed support, noting ongoing coordination.
The announcement avoids full personal details like a real name or location, citing operational security. Reports indicate “UNKN” remains at large in Russia.
Next Steps
Authorities plan to share intelligence with Interpol for arrest warrants. Sanctions against associated wallets are under review. Cybersecurity experts urge organizations to patch vulnerabilities exploited by these groups, such as those in supply chain attacks.
This development ties into global pushes against ransomware, including financial tracking tools that aid in tracing illicit funds. Victims may pursue civil claims using the new information.
NetworkUstad will monitor updates on this case.
