EU Sanctions Vitaly Kovalev, Ransomware Leader of Trickbot Group

• •Vitaly Kovalev, alias 'Stern,' sanctioned for leading the Trickbot ransomware group.
• •Stern has received over $300 million in ransom payments, making him a top ransomware operator.
• •The sanctions target not only individuals but also infrastructure providers enabling cybercrime.

On July 14, 2026, the European Union, in coordination with the U.S. and U.K., sanctioned Vitaly Nikolayevich Kovalev, known as 'Stern,' a key figure in the Trickbot ransomware syndicate. Kovalev is linked to over $300 million in ransom payments through cryptocurrency wallets, marking him as one of the most prolific ransomware operators. The Trickbot group, which he managed, has targeted critical sectors including healthcare and finance, deploying notorious ransomware strains like Conti and Ryuk. The sanctions are part of a broader effort to dismantle cybercrime networks responsible for billions in damages globally. The U.S. Treasury's Office of Foreign Assets Control also targeted infrastructure providers like First VPN Service, emphasizing the need to disrupt the ecosystem supporting these cybercriminals. The coordinated sanctions reflect an escalating international strategy to combat ransomware and cybercrime effectively.