German police name alleged leaders of GandCrab and REvil ransomware groups

  56.10 — Restaurant activities and food delivery services

  47.23 — Retail sale of fish, crustaceans, and mollusks in specialized stores

  47.25.12 — Retail sale of beer in specialized stores

  47.25.2 — Retail sale of soft drinks in specialized stores

  47.29.39 — Retail sale of other food products in specialized stores, not included in other groups

  68.20 — Lease and management of own or leased real estate

Money is reinvested into selling beer and fish :) Interestingly, he registered all that in 2019, just when the ransoms started.

Re: German police name alleged leaders of GandCrab and REvil ransomware groups

#7

Post by ivan_gammel » Mon, Apr 06, 2026, 2:42 PM UTC

kgeist wrote: post #6

alexmocki wrote: post #2

[flagged]

Found his record in Russia's official company registry. This is what he officially does as an entepreneur: 56.10 — Restaurant activities and food delivery services 47.23 — Retail sale of fish, crustaceans, and mollusks in specialized stores 47.25.12 — Retail sale of beer in specialized stores 47.25.2 — Retail sale of soft drinks in specialized stores 47.29.39 — Retail sale of other food products in specialized stores…

Classic money laundering.

Re: German police name alleged leaders of GandCrab and REvil ransomware groups

#8

Post by nailer » Mon, Apr 06, 2026, 3:11 PM UTC

Feels odd for an infosec blog to use 'doxxing' this way. Doxxing is generally considered to be unethical exposure of personal information.

Identifying a criminal is ethical.

Re: German police name alleged leaders of GandCrab and REvil ransomware groups

#9

Post by cucumber3732842 » Mon, Apr 06, 2026, 3:14 PM UTC

nailer wrote: post #8

Feels odd for an infosec blog to use 'doxxing' this way. Doxxing is generally considered to be unethical exposure of personal information. Identifying a criminal is ethical.

>Identifying a criminal is ethical.

This outsourcing of one's morals to the state is excessive even by already high western white collar internet standards.

Now, make no mistake, these guys are up to no good and probably should be identified and prosecuted, but to just declare that a bad thing is now good because government is doing it is basically an abdication of one's moral compass. At best this is still a bad thing but a necessary one because all the other options are worse. Like shooting someone in self defense, or putting someone in a cage for doing sufficiently bad things.

Edit: I'll admit I played too loose with ethics vs morality here, but still the point stands.

Re: German police name alleged leaders of GandCrab and REvil ransomware groups

#10

Post by moffkalast » Mon, Apr 06, 2026, 3:15 PM UTC

nailer wrote: post #8

Feels odd for an infosec blog to use 'doxxing' this way. Doxxing is generally considered to be unethical exposure of personal information. Identifying a criminal is ethical.

I think they obviously just took it as 'exposure of personal information' period.