Danil Alekseevich Shupliakov stands at the intersection of two worlds. In one, he is a young entrepreneur registered with the Russian tax authorities, a director of logistics and construction companies. In the other, he is "gunz"—an alleged member of one of the most destructive cybercriminal syndicates in history, responsible for millions in losses and attacks on critical infrastructure. Whether he is a genius capable of running an international corporation while orchestrating malware attacks from his home in Nizhny Novgorod, or a young man whose legal business is a front for a life of cybercrime, only time will tell. For now, the police continue to ask the public:
Operation Endgame represents the largest ever international strike against botnets used in ransomware attacks. Shupliakov was publicly doxxed and listed as a wanted individual by the BKA on May 23, 2025. The investigation into his activities was bolstered by the analysis of the "Conti-Leaks" and "Trickbotleaks" internal chat logs, which provided law enforcement with unprecedented insight into the group's inner workings.
Initially emerging around 2016 as a banking trojan designed to siphon financial credentials, Trickbot evolved into a highly modular malware framework. Over time, the developers repurposed the botnet infrastructure into an access-broker model. This network structure systematically crippled corporate networks, medical facilities, and government infrastructures worldwide. The Malware Arsenal
Danil Alekseevich Shupliakov (Данил Алексеевич Шупляков) Date of Birth: June 13, 2003 Nationality: Russian Federation Gender: Male Aliases: "gunz," "jamir," "shade," "jade" Language: Russian
Trickbot is a sophisticated, hierarchically structured criminal network that has been active since at least 2016. The group’s operations are characterized by several key activities:
Two days later, Danil stood knee-deep in mud and snow, thirty miles from the nearest paved road. His GPS unit flickered in the cold, but he didn't need it. He had memorized the topography from his grandfather’s sketches.
The Trickbot/Wizard Spider collective utilized a sophisticated multi-stage deployment strategy. The network access facilitated by pentesters like Shupliakov was routinely used to install devastating payloads, including:
The charges against Shupliakov stem from his suspected membership in a foreign criminal organization. According to investigations by the BKA , the Trickbot group utilized a suite of sophisticated malware, including and Ryuk , to extort cryptocurrency from victims after encrypting their data.