EU Sanctions Notorious Ransomware Operator 'Stern' Linked to Trickbot Group

On July 13, 2026, the United States, European Union, and United Kingdom announced sanctions against a network of cybercriminals, including Vitaly Nikolayevich Kovalev, known as 'Stern.' Kovalev is identified as a key figure in the Trickbot Group, responsible for significant ransomware attacks, including those using Conti and Ryuk strains. The sanctions reveal that wallets associated with Stern have received over $300 million in ransom payments, marking him as potentially the largest ransomware operator identified. The Trickbot Group has caused billions in damages to businesses and critical infrastructure globally. The EU's designation of Stern follows previous sanctions against Trickbot members, bringing the total to 19. The group has been involved in extensive ransomware campaigns targeting essential services like healthcare and banking. The sanctions aim to disrupt the operations of these cybercriminal networks and highlight the importance of international cooperation in cybersecurity.

Key Points: • Vitaly Kovalev, alias 'Stern,' is sanctioned as a key operator in the Trickbot ransomware group. • Stern's wallets have received over $300 million in ransom payments, indicating massive scale operations. • The sanctions are part of a broader effort to combat cybercrime and protect critical infrastructure.