Germany Names TrickBot, Conti Ringleader as Russian

Germany’s Federal Criminal Police Office (Bundeskriminalamt, or BKA) has identified the alleged leader of the notorious Conti ransomware and TrickBot cybercrime operations as Vitaly Nikolaevich Kovalev, a 36-year-old Russian national. The announcement marks a significant move by German authorities in their ongoing efforts to dismantle international ransomware networks.

The BKA publicly named Kovalev, who is known by the alias “Stern,” linking him to two of the most damaging cybercriminal groups responsible for extortion campaigns targeting organizations across the globe. Both TrickBot and Conti have been associated with large-scale attacks on critical infrastructure, hospitals, and private companies, causing widespread disruption and financial losses.

The identification follows a broader international crackdown on ransomware operators and their affiliates. German investigators are expected to continue coordinating with global law enforcement partners to pursue further action. The exposure of Kovalev underscores the increasing willingness of authorities to name and pursue high-level figures in cybercrime.