Russian National Linked to Conti and TrickBot Ransomware Operations Identified in Global Crackdown Germany’s Federal Criminal Police Office (BKA) has accused Russian national Vitaly Nikolaevich Kovalev—also known by the alias Stern—of leading the Conti and TrickBot (Wizard Spider) ransomware operations, following a wave of disruptions under Operation Endgame, an international law enforcement initiative targeting cybercrime. Investigations by the BKA revealed that Kovalev played a senior role in TrickBot, Ryuk, and Conti, with the TrickBot group at one point comprising over 100 members operating in a structured, profit-driven hierarchy. The exposure of TrickLeaks and ContiLeaks data earlier accelerated the dismantling of Conti, while authorities now seek information to aid in Kovalev’s arrest. He is believed to be residing in Russia, complicating extradition efforts. This development follows U.S. sanctions imposed on Kovalev over two years ago for his involvement in the same ransomware networks. The case underscores the ongoing challenges in prosecuting high-level cybercriminals operating from jurisdictions with limited cooperation.