Russian Cybercrime Kingpin "Stern" Unmasked as Vitaly Kovalev in Major Law Enforcement Breakthrough German authorities have identified the elusive leader of the notorious Russian cybercrime group Trickbot as Vitaly Nikolaevich Kovalev, a 36-year-old Russian national operating under the alias "Stern." The revelation, announced by Germany’s Bundeskriminalamt (BKA) and local prosecutors, marks a significant milestone in the fight against one of history’s most prolific cybercriminal organizations. For nearly six years, Trickbot—alongside its affiliate group Conti—orchestrated a global hacking campaign, targeting thousands of victims, including businesses, schools, and hospitals. Internal messages from 2020 revealed the group’s ruthless intent, with one member explicitly listing 428 U.S. hospitals for attack. Under Stern’s leadership, the cartel stole hundreds of millions of dollars, cementing its reputation as a dominant force in the Russian cybercriminal underground. Despite previous law enforcement disruptions, including a 2022 leak of over 60,000 internal chat logs, Stern’s true identity remained a closely guarded secret. Kovalev, now the subject of an Interpol red notice, is accused of being the "ringleader" of a criminal organization. German authorities allege he founded Trickbot and operated under the Stern alias, though he has evaded prior sanctions and indictments targeting other group members. The breakthrough came as part of Operation Endgame, a multi-year international effort to dismantle cybercriminal infrastructure. Investigators linked Kovalev to Stern through evidence from a 2023 Qakbot malware investigation and analysis of the leaked Trickbot/Conti chats. The BKA confirmed that the attribution is supported by international partners, though Kovalev’s location in Russia likely shields him from extradition. Threat intelligence analysts, including Alexander Leslie of Recorded Future, describe the unmasking as a critical development in understanding Trickbot’s operations. For years, Stern’s identity was considered "taboo" among researchers, with speculation that law enforcement withheld his name for strategic reasons. Now, the revelation provides a clearer picture of the group’s hierarchy and its ties to the broader cybercrime ecosystem.

Latvian Ransomware Affiliate Sentenced to Over Eight Years for High-Pressure Extortion Attacks A 35-year-old Latvian national, Deniss Zolotarjovs, has been sentenced to 102 months (over eight years) in U.S. prison for his role in a sophisticated ransomware operation linked to multiple cybercriminal groups, including Conti and Akira. Zolotarjovs, who pleaded guilty in July 2025 to money laundering and wire fraud, was extradited from Georgia to the U.S. in August 2024 after his arrest. Prosecutors described Zolotarjovs as a key negotiator for the Karakurt ransomware group, a now-diminished but once-prolific extortion operation tied to dozens of high-profile attacks since 2020. The group operated under multiple aliases, including Conti, Royal, TommyLeaks, SchoolBoys, and Akira, and was based in an office in St. Petersburg, Russia, with alleged ties to former law enforcement officers. Zolotarjovs specialized in escalating pressure tactics during ransom negotiations, earning a 10% cut of payments. His methods included analyzing stolen data to exploit victims’ vulnerabilities, as seen in a 2022 incident where he threatened a pediatric healthcare company by leaking children’s medical records to patients after the organization refused to pay. Between June 2021 and March 2023, he participated in attacks on over 53 companies, contributing to $56 million in losses, including $3 million in ransom payments though prosecutors believe the true financial impact was far greater. Authorities highlighted his English proficiency and aggressive negotiation style, which made him a valuable asset. He even trained a successor who later became the group’s lead negotiator. Despite his arrest, prosecutors warned that the Karakurt-linked operation remains active, with Akira ransomware ranking as the second most observed malware family in 2025, responsible for over 100 attacks this year. The U.S. Department of Justice (DOJ) had pushed for a 126-month sentence, arguing that Zolotarjovs would likely return to cybercrime in Russia after his release. The judge’s ruling removes a skilled and ruthless operator from the criminal ecosystem, though the broader threat persists. Zolotarjovs is the only member of his group to face U.S. prosecution to date.