Germany publishing the identity of UNKN—REvil's operator—after years of attribution silence is less about justice and more about signaling. Nation-states don't dox ransomware operators when prosecutions are the goal; they do it when they want to burn an asset, warn a government, or shift negotiating leverage. The timing, mid-Iran crisis and fracturing US-EU security coordination, isn't incidental.

REvil and GandCrab weren't rogue actors operating despite Kremlin awareness—they were tolerated infrastructure. Exposing UNKN now suggests Germany has made a calculation that the protection umbrella over these groups has either lifted or that the cost of continued silence exceeds the diplomatic value of holding the card.

Watch whether this triggers retaliatory infrastructure targeting in Germany or a broader European context. Doxing without extradition is provocation, not resolution. The next move belongs to Moscow, and it probably won't look like ransomware.