Germany Doxes "UNKN," Head of RU Ransomware Gangs REvil, GandCrab

(krebsonsecurity.com)

96 points | by Bender 2 hours ago

6 comments

  • KingOfCoders 31 minutes ago
    Putting someone on a (most) wanted list is "doxing"?

    [Edit] "An international search is underway for Daniil Maksimovich SHCHUKIN on suspicion of numerous counts of gang-related and commercial extortion using ransomware to the detriment of commercial enterprises, public facilities, and institutions."

    • embedding-shape 12 minutes ago
      > Putting someone on a (most) wanted list is "doxing"?

      No, if they just put UNKN on the most wanted list, then it wouldn't be doxing. But then they also tie UNKN together with "Daniil Maksimovich Shchukin", and that's the doxxing, regardless or not if it's on a most wanted list.

      • KingOfCoders 7 minutes ago
        I think this is not how wanted lists work, here in Germany at least. Do they work this way where you are living? The goal of wanted lists in Germany is to find the person the police is searching for to put them in front of a court if the prosecution can make a case.
    • moomin 23 minutes ago
      Yeah, I’m not okay with this. Doxxing is a term with an extremely negative connotation and is often done to people who, bluntly, weren’t hiding or doing anything wrong. The correct term for the same act here is either “accuse” or “unmask”.
      • embedding-shape 13 minutes ago
        If someone wasn't previously known, only an alias or alter-ego, but you then link those together with a real-life identity, that's very much the definition of "doxxing", at least the original definition, maybe it's different today? Positive or negative doesn't really matter, just like "shooting" or "jumping" in itself isn't positive or negative, it's just a verb.
    • mc32 28 minutes ago
      Unfortunately language tends to get diluted. Nowadays in pop culture it means publishing anyone's personal information, usually against their wishes.
      • KingOfCoders 25 minutes ago
        “When I use a word,” Humpty Dumpty said, in rather a scornful tone, “it means just what I choose it to mean — neither more nor less.”
  • Phelinofist 1 hour ago
    Spiegel recently did a video on them: https://www.youtube.com/watch?v=HuwRrqM6H1M
  • nailer 56 minutes ago
    Feels odd for an infosec blog to use 'doxxing' this way. Doxxing is generally considered to be unethical exposure of personal information.

    Identifying a criminal is ethical.

    • moffkalast 52 minutes ago
      I think they obviously just took it as 'exposure of personal information' period.
    • cucumber3732842 53 minutes ago
      >Identifying a criminal is ethical.

      This outsourcing of one's morals to the state is excessive even by already high western white collar internet standards.

      Now, make no mistake, these guys are up to no good and probably should be identified and prosecuted, but to just declare that a bad thing is now good because government is doing it is basically an abdication of one's moral compass. At best this is still a bad thing but a necessary one because all the other options are worse. Like shooting someone in self defense, or putting someone in a cage for doing sufficiently bad things.

      Edit: I'll admit I played too loose with ethics vs morality here, but still the point stands.

      • Yokohiii 26 minutes ago
        Certainly, criminals also have a right to privacy. However, the limited publication of personal data of criminals by law enforcement is generally a legally legitimate measure. Doxxing, on the other hand, is generally a process that violates the fundamental right to privacy.
        • cucumber3732842 16 minutes ago
          >criminals

          >law

          >legally

          You keep using these words but it causes circular logic as those are all defined by the same entity that is acting unilaterally.

          The action the government took was not a "good" action by any moral standard. But it was perhaps the least worse auction. Can't just whisk people off the street in a foreign country or drone them over such matters, those options would be worse.

          • zaphar 1 minute ago
            Is it your position that privacy is a right regardless of any action you take? Many rights are dependent on circumstance and in tension with other rights. In this case I think you can make the case that their right to privacy is lost.
      • wswin 42 minutes ago
        not the state, but the law
      • dmos62 50 minutes ago
        Innocent until proven guilty (in a court of law)?
      • wat10000 51 minutes ago
        "Identifying a criminal" doesn't imply that it's done by the government, and being done by the government doesn't imply that it's done to a criminal. This comment seems like quite a leap.
        • jstanley 44 minutes ago
          It's the government who defines what "criminal" means.
          • wat10000 38 minutes ago
            Not necessarily. I'm free to make my own determination on the matter.
      • gigatexal 39 minutes ago
        ethics and morality are not interchangeable are they?

        anyway individuals willingly give to teh state some autonomy in return for the safety of governance... that's the social contract free people have with government

        "doxxing" a Russian ransomware group is the kind thing to do. bombing them out of existence is within the remit of the range of ideas a government could resort to...

        • mc32 32 minutes ago
          Not disagreeing with your preface but I was under the impression that while it took governments some time to figure things out, kinetic bombing in retaliation for cyberwarfare was pretty much ruled out unless the cyberwarfare results in direct mass casualties (for example cyber sabotaging a refinery results in an explosion which results in casualties.). Else we’d have bombed North Korea, China, Ukraine, Russia, Romania, etc.
    • layer8 20 minutes ago
      > Identifying a criminal is ethical.

      I agree that “doxxing” is being misused in TFA, but criminals have privacy rights like anyone else. Violating these rights requires specific justification, it’s not automatically ethical.

      • KingOfCoders 14 minutes ago
        They put the person on a wanted list.
        • layer8 11 minutes ago
          My comment isn’t about this specific case. It’s about the general claim.
  • dfir-lab 21 minutes ago
    [dead]
  • user070707 21 minutes ago
    [flagged]
  • alexmocki 2 hours ago
    This reads less like “hacking” and more like an optimized business.

    Clear specialization, outsourcing, and reinvestment — very similar to how startups scale.

    • kgeist 1 hour ago
      Found his record in Russia's official company registry. This is what he officially does as an entepreneur:

        56.10 — Restaurant activities and food delivery services
      
        47.23 — Retail sale of fish, crustaceans, and mollusks in specialized stores
      
        47.25.12 — Retail sale of beer in specialized stores
      
        47.25.2 — Retail sale of soft drinks in specialized stores
      
        47.29.39 — Retail sale of other food products in specialized stores, not included in other groups
      
        68.20 — Lease and management of own or leased real estate
      
      Money is reinvested into selling beer and fish :) Interestingly, he registered all that in 2019, just when the ransoms started.
      • ivan_gammel 1 hour ago
        Classic money laundering.
      • tokai 20 minutes ago
        > 56.10 — Restaurant activities and food delivery services

        That one is a classic for russian criminals and warlords.

    • wat10000 47 minutes ago
      Go look at the al Qaeda emails recovered from the raid that killed bin Laden and you'll find all the same stuff. Turns out that the way businesses operate is just a good way to operate human organizations in general, whether their goal is to sell widgets or blow up infidels.
    • raverbashing 1 hour ago
      Ah yes a business like the mafia
      • tgv 1 hour ago
        The parent commenter has apparently never heard of organized crime.