Germany Doxes Conti & TrickBot Leader
- German authorities have identified Vitaly Nikolaevich Kovalev, a 36-year-old Russian, as the leader of the Trickbot and Conti cybercrime gangs.the Federal Criminal Police office of Germany (BKA) announced...
- The BKA said the Trickbot group, also known as Wizard Spider, utilized Trickbot malware along with other variants like Bazarloader, SystemBC, IcedID, Ryuk, Conti, and Diavol.
- Kovalev was previously sanctioned and charged in the United States in February 2023 for his involvement with TrickBot and Conti. At that time, he was identified as a...
German authorities have identified Vitaly Nikolaevich Kovalev, a Russian national, as the leader of the notorious Trickbot and Conti ransomware gangs. The Federal Criminal Police of Germany (BKA) revealed Kovalev’s identity as part of Operation Endgame, a global effort targeting malware infrastructure. Kovalev, also known as “Stern,” is now wanted by German police and subject to an interpol red notice for allegedly leading a criminal organization responsible for infecting hundreds of thousands of systems.Discover how the Trickbot group, known for malware variants like Bazarloader and Ryuk, caused significant damage to hospitals and public facilities. News Directory 3 provides further insights into the global law enforcement strategy to combat cybercrime. What further revelations will emerge about Kovalev’s online accounts and whereabouts as international investigations continue?
German police Name Kovalev as Trickbot, Conti Ransomware Leader
Updated May 30, 2025
German authorities have identified Vitaly Nikolaevich Kovalev, a 36-year-old Russian, as the leader of the Trickbot and Conti cybercrime gangs.the Federal Criminal Police office of Germany (BKA) announced the identification as part of Operation Endgame,a global law enforcement effort targeting malware infrastructure.
The BKA said the Trickbot group, also known as Wizard Spider, utilized Trickbot malware along with other variants like Bazarloader, SystemBC, IcedID, Ryuk, Conti, and Diavol. Kovalev is now wanted in Germany and is the subject of an Interpol red notice for allegedly leading a criminal organization.
Kovalev was previously sanctioned and charged in the United States in February 2023 for his involvement with TrickBot and Conti. At that time, he was identified as a senior figure within the Trickbot group, using aliases such as “Bentley,” “Bergen,” “Alex Konor,” and “Ben.”
Leaks of internal conversations from TrickBot and Conti, known as TrickLeaks and ContiLeaks, exposed Kovalev, under the alias “Stern,” as the head of the TrickBot operation and the Ryuk and Conti ransomware gangs. Thes leaks revealed that other members sought Stern’s approval before launching attacks or hiring lawyers for arrested members.
The ContiLeaks incident contributed to Conti’s shutdown, with members dispersing to other operations or forming new gangs, including Royal, Black Basta, BlackCat, AvosLocker, Karakurt, LockBit, Silent Ransom, DagonLocker, and ZEON.
The BKA stated that the Trickbot group consisted of over 100 members, operating in a structured and hierarchical manner.The group is allegedly responsible for infecting hundreds of thousands of systems globally, causing damages in the three-digit million range to hospitals, public facilities, companies, public authorities, and private individuals.
Kovalev’s current location is unknown, but German police believe he resides in Russia. They are seeking facts that could lead to his capture, including his online accounts and interaction channels.
What’s next
Law enforcement agencies continue to collaborate internationally to dismantle cybercrime networks and bring individuals like Kovalev to justice. The investigation remains active as authorities seek to gather more information about kovalev’s activities and whereabouts.