Vitaly Kovalev, who is wanted by German authorities as the alleged founder and leader of Trickbot, one of the largest cybercriminal groups in the world, worked as an adviser to State Duma Deputy Speaker Vladislav Davankov and ran for the State Duma on the New People party’s ticket. The GangExposed project first drew attention to the connection between Kovalev and Davankov.
Davankov himself wrote in August 2025 that Kovalev had been his adviser for “more than a year,” describing him as a supporter of New People, an entrepreneur, and a med tech investor. Together they visited the longevity laboratory at Volgograd State Medical University, and Kovalev, according to Davankov, was tasked with promoting the university’s products in the region. Davankov’s post was also shared by VolgSMU’s official channel.
Kovalev was nominated to run for the State Duma with New People. However, when the party’s federal list was certified on July 10, the state-controlled Vedomosti newspaper reported that Kovalev had been removed from regional group No. 18, which included Kalmykia and the Astrakhan and Volgograd regions. Kovalev’s is no longer among the 298 names on the list that was ultimately registered by the Central Election Commission.
Germany’s Federal Criminal Police Office (BKA) is seeking Vitaly Nikolayevich Kovalev, born June 23, 1988. German investigators believe that under the aliases Stern and Ben, he founded and led the Trickbot hacker group. His wanted notice also lists other aliases: Grave, Vincent, Bentley, Bergen, and Alex Konor. The BKA believes Kovalev is in Russia.
According to the BKA, Trickbot had been operating since at least 2016 and, at various points, boasted more than 100 members, who used its infrastructure for spreading malware of the same name, as well as Bazarloader, SystemBC, IcedID, Ryuk, Conti, and Diavol tools. The group infected hundreds of thousands of computer systems worldwide, earning hundreds of millions of euros from its criminal activity. Its victims included hospitals, government agencies, companies, and private individuals.
In May 2025, German authorities obtained international arrest warrants for members of various cybercriminal groups as part of Operation Endgame. The BKA stated that international warrants had been issued for 20 suspects and that an Interpol Red Notice was also issued for Kovalev, obligating law enforcement agencies in other countries to locate him and, if possible, provisionally detain him pending an extradition decision.
In July 2026, the Council of the EU added Kovalev to its sanctions list over his involvement in cyberattacks. The document lists Kovalev’s full name, date of birth, and the aliases Bentley, Bergen, Alex Konor, Benny, Ben, and Stern. The EU describes Kovalev as a senior figure linked to the Trickbot group and Conti malware and holds him responsible for cyberattacks that caused significant economic damage.
Trickbot was used for initial access into computer systems, theft of banking and personal data, and the subsequent deployment of ransomware. The U.S. Department of Justice stated that Trickbot had infected millions of computers, including at hospitals, schools, and companies, and that its infrastructure was used to spread Conti.
Conti became one of the largest ransomware operations in history. According to the U.S. Department of Justice, it was used in more than a thousand attacks worldwide, and ransoms paid by victims exceeded $150 million. The FBI recorded at least 16 Conti attacks on U.S. medical and emergency networks, including ambulance services, police, and 911 dispatch centers. Worldwide, more than 400 organizations were affected.
Ransomware linked to Trickbot’s infrastructure caused especially severe damage to healthcare systems during the COVID-19 pandemic. Materials from a U.S. Senate hearing state that more than 200 attacks using Ryuk, which is closely tied to the Trickbot and Conti ecosystem, resulted in nearly $100 million in lost revenue for medical organizations and roughly $500 million in system recovery costs.
