Germany Doxes "UNKN," Head of RU Ransomware Gangs REvil, GandCrab

(krebsonsecurity.com)

111 points | by Bender 2 hours ago

6 comments

  • KingOfCoders 51 minutes ago
    Putting someone on a (most) wanted list is "doxing"?

    [Edit] "An international search is underway for Daniil Maksimovich SHCHUKIN on suspicion of numerous counts of gang-related and commercial extortion using ransomware to the detriment of commercial enterprises, public facilities, and institutions."

    • embedding-shape 32 minutes ago
      > Putting someone on a (most) wanted list is "doxing"?

      No, if they just put UNKN on the most wanted list, then it wouldn't be doxing. But then they also tie UNKN together with "Daniil Maksimovich Shchukin", and that's the doxxing, regardless or not if it's on a most wanted list.

      • KingOfCoders 27 minutes ago
        I think this is not how wanted lists work, here in Germany at least. Do they work this way where you are living? The goal of wanted lists in Germany is to find the person the police is searching for to put them in front of a court if the prosecution can make a case.

        Perhaps this goes back to leftist terrorism in Germany in the 1970s, they would not use the code names of terrorists on the wanted lists but their real names to find them, because this is what they wanted - but I don't know.

        • embedding-shape 8 minutes ago
          What do you mean "this is not how wanted lists work"? The goal everywhere is to find the people on the wanted list, that's why they're called "wanted" in the first place. Is there something in my comment indicating I don't believe wanted lists are for finding people?
          • KingOfCoders 5 minutes ago
            "No, if they just put UNKN on the most wanted list, then it wouldn't be doxing."

            I misread that as it either would be the thing to do or an alternative option and you were against putting names on a wanted list.

            • embedding-shape 4 minutes ago
              No, I was just trying to clarify that the "doxxing" part is not the "add $name to $list" but "tie $alias to $real-name".
    • moomin 43 minutes ago
      Yeah, I’m not okay with this. Doxxing is a term with an extremely negative connotation and is often done to people who, bluntly, weren’t hiding or doing anything wrong. The correct term for the same act here is either “accuse” or “unmask”.
      • embedding-shape 33 minutes ago
        If someone wasn't previously known, only an alias or alter-ego, but you then link those together with a real-life identity, that's very much the definition of "doxxing", at least the original definition, maybe it's different today? Positive or negative doesn't really matter, just like "shooting" or "jumping" in itself isn't positive or negative, it's just a verb.
        • usrusr 17 minutes ago
          And if the police actually catches the accused and puts them in jail, is that kidnapping? Most verbs have far more semantics than just the most basic before/after state diff.
          • embedding-shape 7 minutes ago
            Well, no, kidnapping is unlawful abduction. But abduction is always abduction, regardless of who does it, police can abduct people too, but when criminals do so, we call it kidnapping, since it's illegal. Not sure what point you were trying to make, but I think it failed to land properly.
          • KPGv2 4 minutes ago
            I have, admittedly, only been on the Internet for thirty-five years or so, but I seem to recall that a long time ago reading about people "doxxing" guys who posted pictures of them torturing cats and dogs.

            "Doxxing" certainly doesn't carry a negative connotation in that usage. Unless you live in a culture where torturing domesticated animals is a good thing.

            ANd I recall that, before that, hackers would doxx other hackers in the 90s in order to get them arrested. Again, that seems like the exact same usage as here: tying a pseudonym to an IRL for purposes of law enforcement.

        • rwmj 8 minutes ago
          If you want an alias that's fine, just don't use it to do crimes.
        • ffsm8 8 minutes ago
          [dead]
    • busterarm 15 minutes ago
      also it seems the US had already identified him 3 years prior?
    • mc32 48 minutes ago
      Unfortunately language tends to get diluted. Nowadays in pop culture it means publishing anyone's personal information, usually against their wishes.
      • KingOfCoders 45 minutes ago
        “When I use a word,” Humpty Dumpty said, in rather a scornful tone, “it means just what I choose it to mean — neither more nor less.”
  • Phelinofist 1 hour ago
    Spiegel recently did a video on them: https://www.youtube.com/watch?v=HuwRrqM6H1M
  • nailer 1 hour ago
    Feels odd for an infosec blog to use 'doxxing' this way. Doxxing is generally considered to be unethical exposure of personal information.

    Identifying a criminal is ethical.

    • KPGv2 2 minutes ago
      "Doxxing" is from the 90s and was used to describe a hacker unmasking another hacker so they could be arrested. That's almost exactly the same usage as here.
    • moffkalast 1 hour ago
      I think they obviously just took it as 'exposure of personal information' period.
    • cucumber3732842 1 hour ago
      >Identifying a criminal is ethical.

      This outsourcing of one's morals to the state is excessive even by already high western white collar internet standards.

      Now, make no mistake, these guys are up to no good and probably should be identified and prosecuted, but to just declare that a bad thing is now good because government is doing it is basically an abdication of one's moral compass. At best this is still a bad thing but a necessary one because all the other options are worse. Like shooting someone in self defense, or putting someone in a cage for doing sufficiently bad things.

      Edit: I'll admit I played too loose with ethics vs morality here, but still the point stands.

      • Yokohiii 46 minutes ago
        Certainly, criminals also have a right to privacy. However, the limited publication of personal data of criminals by law enforcement is generally a legally legitimate measure. Doxxing, on the other hand, is generally a process that violates the fundamental right to privacy.
        • KPGv2 1 minute ago
          > Doxxing, on the other hand, is generally a process that violates the fundamental right to privacy.

          It historically was used for this exact case: revealing someone hiding behind a pseudonym for purposes of law enforcement. The term dates back to the 90s, if not earlier.

          This isn't something Gen Z made up. It's a Gen X term. "Hack the gibson" era. Wargames era.

        • cucumber3732842 36 minutes ago
          >criminals

          >law

          >legally

          You keep using these words but it causes circular logic as those are all defined by the same entity that is acting unilaterally.

          The action the government took was not a "good" action by any moral standard. But it was perhaps the least worse auction. Can't just whisk people off the street in a foreign country or drone them over such matters, those options would be worse.

          • Yokohiii 0 minutes ago
            > You keep using these words but it causes circular logic as those are all defined by the same entity that is acting unilaterally.

            It's not, in Germany we have separation of powers.

            > The action the government took was not a "good" action by any moral standard.

            Morals aren't binary. Morals have context.

          • oytis 4 minutes ago
            Running a ransomware gang is immoral. Catching someone running a ransomware gang is good. If publishing their name helps catch them, it's also good. Not sure where do you see the gap between legality and morality in this case
          • zaphar 22 minutes ago
            Is it your position that privacy is a right regardless of any action you take? Many rights are dependent on circumstance and in tension with other rights. In this case I think you can make the case that their right to privacy is lost.
      • wswin 1 hour ago
        not the state, but the law
      • dmos62 1 hour ago
        Innocent until proven guilty (in a court of law)?
      • wat10000 1 hour ago
        "Identifying a criminal" doesn't imply that it's done by the government, and being done by the government doesn't imply that it's done to a criminal. This comment seems like quite a leap.
        • jstanley 1 hour ago
          It's the government who defines what "criminal" means.
          • wat10000 58 minutes ago
            Not necessarily. I'm free to make my own determination on the matter.
            • zaphar 19 minutes ago
              You are certainly free to make up your own definitions for words and speak a dialect that is niche but you will not be effectively communicating when you do. By commonly understood definition criminality is a matter of law.
      • gigatexal 59 minutes ago
        ethics and morality are not interchangeable are they?

        anyway individuals willingly give to teh state some autonomy in return for the safety of governance... that's the social contract free people have with government

        "doxxing" a Russian ransomware group is the kind thing to do. bombing them out of existence is within the remit of the range of ideas a government could resort to...

        • mc32 52 minutes ago
          Not disagreeing with your preface but I was under the impression that while it took governments some time to figure things out, kinetic bombing in retaliation for cyberwarfare was pretty much ruled out unless the cyberwarfare results in direct mass casualties (for example cyber sabotaging a refinery results in an explosion which results in casualties.). Else we’d have bombed North Korea, China, Ukraine, Russia, Romania, etc.
    • layer8 40 minutes ago
      > Identifying a criminal is ethical.

      I agree that “doxxing” is being misused in TFA, but criminals have privacy rights like anyone else. Violating these rights requires specific justification, it’s not automatically ethical.

      • KingOfCoders 34 minutes ago
        They put the person on a wanted list.
        • layer8 31 minutes ago
          My comment isn’t about this specific case. It’s about the general claim.
  • dfir-lab 41 minutes ago
    [dead]
  • user070707 41 minutes ago
    [flagged]
  • alexmocki 2 hours ago
    This reads less like “hacking” and more like an optimized business.

    Clear specialization, outsourcing, and reinvestment — very similar to how startups scale.

    • kgeist 1 hour ago
      Found his record in Russia's official company registry. This is what he officially does as an entepreneur:

        56.10 — Restaurant activities and food delivery services
      
        47.23 — Retail sale of fish, crustaceans, and mollusks in specialized stores
      
        47.25.12 — Retail sale of beer in specialized stores
      
        47.25.2 — Retail sale of soft drinks in specialized stores
      
        47.29.39 — Retail sale of other food products in specialized stores, not included in other groups
      
        68.20 — Lease and management of own or leased real estate
      
      Money is reinvested into selling beer and fish :) Interestingly, he registered all that in 2019, just when the ransoms started.
      • ivan_gammel 1 hour ago
        Classic money laundering.
      • tokai 41 minutes ago
        > 56.10 — Restaurant activities and food delivery services

        That one is a classic for russian criminals and warlords.

    • wat10000 1 hour ago
      Go look at the al Qaeda emails recovered from the raid that killed bin Laden and you'll find all the same stuff. Turns out that the way businesses operate is just a good way to operate human organizations in general, whether their goal is to sell widgets or blow up infidels.
    • raverbashing 2 hours ago
      Ah yes a business like the mafia
      • tgv 2 hours ago
        The parent commenter has apparently never heard of organized crime.