German prosecutors identify two Russian nationals, Daniil Maksimovich Shchukin and Anatoly Sergeevitsch Kravchu, as operators behind the GandCrab and REvil ransomware networks and place them on an international arrest warrant.

The suspects are suspected of orchestrating large-scale cyberattacks and digital extortion, with affiliates handling attacks and revenue sharing in a coordinated network.

From 2018 to 2021, GandCrab and REvil attacked numerous firms, encrypting data and demanding ransom, causing hundreds of millions in damage and reaching global impact.

The operations relied on a distributed “partnership” model where organizers provided infrastructure and software while affiliates conducted intrusions and split proceeds.

REvil is linked to high-profile campaigns, including the 2021 Kaseya incident that affected customers in at least 17 countries, illustrating the breadth of disruption.

Recent attacks also targeted Germany’s Left Party IT systems, highlighting continued cross-border reach and Europe-wide impact.

Germany faces estimated damages around €35 million from these incidents, with total global damages potentially reaching hundreds of millions.

A cyberattack on March 28 targeted EU institutions, signaling cross-border data theft linked to GandCrab/REvil operations.

Suspected leaders disappeared from public view in mid-2021, with the overall financial and operational damage from these groups continuing to accumulate.

Germany has recorded about 130 attacks on companies and institutions, including healthcare and cultural entities, with substantial costs and some ransom payments.

In Germany alone, roughly €35 million in costs and about €1.8 million paid in a subset of 25 cases reflect the economic toll.

Investigators rely on cryptocurrency tracing and international cooperation to map the network, revealing a global collaboration among organizers and affiliates.