Germany Doxes "UNKN," Head of RU Ransomware Gangs REvil, GandCrab

(krebsonsecurity.com)

105 points | by Bender 2 hours ago

6 comments

  • KingOfCoders 45 minutes ago
    Putting someone on a (most) wanted list is "doxing"?

    [Edit] "An international search is underway for Daniil Maksimovich SHCHUKIN on suspicion of numerous counts of gang-related and commercial extortion using ransomware to the detriment of commercial enterprises, public facilities, and institutions."

    • embedding-shape 25 minutes ago
      > Putting someone on a (most) wanted list is "doxing"?

      No, if they just put UNKN on the most wanted list, then it wouldn't be doxing. But then they also tie UNKN together with "Daniil Maksimovich Shchukin", and that's the doxxing, regardless or not if it's on a most wanted list.

      • KingOfCoders 20 minutes ago
        I think this is not how wanted lists work, here in Germany at least. Do they work this way where you are living? The goal of wanted lists in Germany is to find the person the police is searching for to put them in front of a court if the prosecution can make a case.

        Perhaps this goes back to leftist terrorism in Germany in the 1970s, they would not use the code names of terrorists on the wanted lists but their real names to find them, because this is what they wanted - but I don't know.

        • embedding-shape 2 minutes ago
          What do you mean "this is not how wanted lists work"? The goal everywhere is to find the people on the wanted list, that's why they're called "wanted" in the first place. Is there something in my comment indicating I don't believe wanted lists are for finding people?
      • snarf_br 1 minute ago
        That is a very idiotic take.

        Most wanted lists work with real identities.

        This was not nor will it ever ne doxxing.

    • moomin 37 minutes ago
      Yeah, I’m not okay with this. Doxxing is a term with an extremely negative connotation and is often done to people who, bluntly, weren’t hiding or doing anything wrong. The correct term for the same act here is either “accuse” or “unmask”.
      • embedding-shape 26 minutes ago
        If someone wasn't previously known, only an alias or alter-ego, but you then link those together with a real-life identity, that's very much the definition of "doxxing", at least the original definition, maybe it's different today? Positive or negative doesn't really matter, just like "shooting" or "jumping" in itself isn't positive or negative, it's just a verb.
        • rwmj 1 minute ago
          If you want an alias that's fine, just don't use it to do crimes.
        • usrusr 10 minutes ago
          And if the police actually catches the accused and puts them in jail, is that kidnapping? Most verbs have far more semantics than just the most basic before/after state diff.
        • ffsm8 2 minutes ago
          [dead]
    • busterarm 8 minutes ago
      also it seems the US had already identified him 3 years prior?
    • mc32 41 minutes ago
      Unfortunately language tends to get diluted. Nowadays in pop culture it means publishing anyone's personal information, usually against their wishes.
      • KingOfCoders 39 minutes ago
        “When I use a word,” Humpty Dumpty said, in rather a scornful tone, “it means just what I choose it to mean — neither more nor less.”
  • Phelinofist 1 hour ago
    Spiegel recently did a video on them: https://www.youtube.com/watch?v=HuwRrqM6H1M
  • nailer 1 hour ago
    Feels odd for an infosec blog to use 'doxxing' this way. Doxxing is generally considered to be unethical exposure of personal information.

    Identifying a criminal is ethical.

    • moffkalast 1 hour ago
      I think they obviously just took it as 'exposure of personal information' period.
    • cucumber3732842 1 hour ago
      >Identifying a criminal is ethical.

      This outsourcing of one's morals to the state is excessive even by already high western white collar internet standards.

      Now, make no mistake, these guys are up to no good and probably should be identified and prosecuted, but to just declare that a bad thing is now good because government is doing it is basically an abdication of one's moral compass. At best this is still a bad thing but a necessary one because all the other options are worse. Like shooting someone in self defense, or putting someone in a cage for doing sufficiently bad things.

      Edit: I'll admit I played too loose with ethics vs morality here, but still the point stands.

      • Yokohiii 39 minutes ago
        Certainly, criminals also have a right to privacy. However, the limited publication of personal data of criminals by law enforcement is generally a legally legitimate measure. Doxxing, on the other hand, is generally a process that violates the fundamental right to privacy.
        • cucumber3732842 29 minutes ago
          >criminals

          >law

          >legally

          You keep using these words but it causes circular logic as those are all defined by the same entity that is acting unilaterally.

          The action the government took was not a "good" action by any moral standard. But it was perhaps the least worse auction. Can't just whisk people off the street in a foreign country or drone them over such matters, those options would be worse.

          • zaphar 15 minutes ago
            Is it your position that privacy is a right regardless of any action you take? Many rights are dependent on circumstance and in tension with other rights. In this case I think you can make the case that their right to privacy is lost.
      • wswin 56 minutes ago
        not the state, but the law
      • dmos62 1 hour ago
        Innocent until proven guilty (in a court of law)?
      • wat10000 1 hour ago
        "Identifying a criminal" doesn't imply that it's done by the government, and being done by the government doesn't imply that it's done to a criminal. This comment seems like quite a leap.
        • jstanley 57 minutes ago
          It's the government who defines what "criminal" means.
          • wat10000 51 minutes ago
            Not necessarily. I'm free to make my own determination on the matter.
            • zaphar 13 minutes ago
              You are certainly free to make up your own definitions for words and speak a dialect that is niche but you will not be effectively communicating when you do. By commonly understood definition criminality is a matter of law.
      • gigatexal 52 minutes ago
        ethics and morality are not interchangeable are they?

        anyway individuals willingly give to teh state some autonomy in return for the safety of governance... that's the social contract free people have with government

        "doxxing" a Russian ransomware group is the kind thing to do. bombing them out of existence is within the remit of the range of ideas a government could resort to...

        • mc32 45 minutes ago
          Not disagreeing with your preface but I was under the impression that while it took governments some time to figure things out, kinetic bombing in retaliation for cyberwarfare was pretty much ruled out unless the cyberwarfare results in direct mass casualties (for example cyber sabotaging a refinery results in an explosion which results in casualties.). Else we’d have bombed North Korea, China, Ukraine, Russia, Romania, etc.
    • layer8 33 minutes ago
      > Identifying a criminal is ethical.

      I agree that “doxxing” is being misused in TFA, but criminals have privacy rights like anyone else. Violating these rights requires specific justification, it’s not automatically ethical.

      • KingOfCoders 28 minutes ago
        They put the person on a wanted list.
        • layer8 24 minutes ago
          My comment isn’t about this specific case. It’s about the general claim.
  • dfir-lab 35 minutes ago
    [dead]
  • user070707 34 minutes ago
    [flagged]
  • alexmocki 2 hours ago
    This reads less like “hacking” and more like an optimized business.

    Clear specialization, outsourcing, and reinvestment — very similar to how startups scale.

    • kgeist 1 hour ago
      Found his record in Russia's official company registry. This is what he officially does as an entepreneur:

        56.10 — Restaurant activities and food delivery services
      
        47.23 — Retail sale of fish, crustaceans, and mollusks in specialized stores
      
        47.25.12 — Retail sale of beer in specialized stores
      
        47.25.2 — Retail sale of soft drinks in specialized stores
      
        47.29.39 — Retail sale of other food products in specialized stores, not included in other groups
      
        68.20 — Lease and management of own or leased real estate
      
      Money is reinvested into selling beer and fish :) Interestingly, he registered all that in 2019, just when the ransoms started.
      • ivan_gammel 1 hour ago
        Classic money laundering.
      • tokai 34 minutes ago
        > 56.10 — Restaurant activities and food delivery services

        That one is a classic for russian criminals and warlords.

    • wat10000 1 hour ago
      Go look at the al Qaeda emails recovered from the raid that killed bin Laden and you'll find all the same stuff. Turns out that the way businesses operate is just a good way to operate human organizations in general, whether their goal is to sell widgets or blow up infidels.
    • raverbashing 2 hours ago
      Ah yes a business like the mafia
      • tgv 1 hour ago
        The parent commenter has apparently never heard of organized crime.