Germany Doxes “UNKN,” Head of RU Ransomware Gangs REvil, GandCrab
2026-04-06T13:23:43Z•dc4295ff99eb9cc830f17d2f9f4bdec87e923f6f53a613182d2cb245e50ffe8b
AI securityAisuruCanisterWormDDoSDaniil ShchukinGandCrabIoT botnetIranJackSkidKimwolfMFA bypassMicrosoft Patch TuesdayMossadREvilStarkillerStrykerbotnet takedowndoxingphishing-as-a-serviceransomwarevulnerabilitieswiperzero-day
What happened
KrebsOnSecurity roundup (Feb–Apr 2026): German authorities identified and doxed Daniil Shchukin as “UNKN,” the alleged head of GandCrab and REvil. New destructive campaigns include the CanisterWorm wiper targeting systems configured to Iran time/Farsi and an Iran-linked wiper claimed against medtech firm Stryker. Law enforcement disrupted the infrastructure for four massive IoT botnets (Aisuru, Kimwolf, JackSkid, Mossad) that powered record DDoS attacks; Kimwolf’s botmaster (“Dort”) remains active and has been used to harass researchers and swamp I2P. A stealthy phishing-as-a-service named “St
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- krebs_on_security
- Record identifier
- dc4295ff99eb9cc830f17d2f9f4bdec87e923f6f53a613182d2cb245e50ffe8b
- Enrichment time
- 2026-04-06T13:23:43Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.