Germany Identifies Leader of Conti Ransomware and TrickBot Cybercrime Groups

TL;DR

The German Federal Criminal Police Office (BKA) has identified Vitaly Nikolaevich Kovalev, a 36-year-old Russian, as the leader of the TrickBot and Conti ransomware cybercrime groups, known under the alias “Stern.” This revelation sheds light on the ongoing efforts to dismantle these notorious cybercrime operations.

Germany Identifies Leader of Conti Ransomware and TrickBot Cybercrime Groups

In a significant development, the Federal Criminal Police Office of Germany (Bundeskriminalamt or BKA) has publicly identified the leader of the notorious TrickBot and Conti ransomware cybercrime groups. According to the BKA, the individual behind these operations is Vitaly Nikolaevich Kovalev, a 36-year-old Russian national known by the alias “Stern”¹.

Background on TrickBot and Conti Ransomware

TrickBot, initially reported in October 2016, started as a banking Trojan designed to steal financial information and other credentials. Over time, its capabilities have expanded significantly, evolving into a modular malware ecosystem. TrickBot’s functionalities include:

• Propagation Methods: Spread through executable programs, batch files, email phishing, and even fake sexual harassment claims.
• Targets: PayPal, CRM systems, security software like Microsoft Defender, and even mobile PIN codes.
• Advanced Features: Self-spreading worm components, DKIM support to bypass email filters, and the ability to steal various types of sensitive data.
• Collaboration with Other Malware: TrickBot has been known to provide access-as-a-service to other malware, including Ryuk and Conti ransomware².

Conti Ransomware, on the other hand, is a sophisticated ransomware-as-a-service (RaaS) operation that has been responsible for numerous high-profile attacks. The group behind Conti is known for its aggressive tactics and significant ransom demands.

Impact and Significance

The identification of Vitaly Nikolaevich Kovalev as the leader of these cybercrime groups is a major breakthrough in the ongoing efforts to combat cybercrime. Both TrickBot and Conti ransomware have caused substantial damage, targeting various sectors including healthcare, finance, and critical infrastructure.

In 2020, TrickBot was involved in a series of cyber attacks on US hospitals and healthcare systems, highlighting the severe threat it poses. The FBI and other US federal agencies have repeatedly warned about the imminent cybercrime threat, particularly during the COVID-19 pandemic³.

Ongoing Efforts to Dismantle Cybercrime Operations

The efforts to dismantle TrickBot and Conti ransomware operations have been extensive and collaborative. In 2020, the TrickBot botnet faced significant disruptions from what is believed to be the US Cyber Command and several security companies. These actions included delivering configuration files to infected systems that redirected command and control server addresses to localhost, effectively cutting off communication with the botnet⁴.

Conclusion

The public identification of Vitaly Nikolaevich Kovalev as the leader of the TrickBot and Conti ransomware groups is a crucial step forward in the fight against cybercrime. This development underscores the importance of international cooperation and sustained efforts to dismantle these criminal operations. As cyber threats continue to evolve, so must the strategies to combat them, ensuring a safer digital landscape for all.

For further insights, check: BleepingComputer

References

1. BleepingComputer (2025). “Germany doxxes Conti ransomware and Trickbot ring leader”. BleepingComputer. Retrieved 2025-05-30. ↩︎

2. BleepingComputer (2025). “The Evolution of TrickBot: From Banking Trojan to Modular Malware”. BleepingComputer. Retrieved 2025-05-30. ↩︎

3. FBI (2020). “FBI Warns of Imminent Cybercrime Threat to US Hospitals”. FBI. Retrieved 2025-05-30. ↩︎

4. Microsoft (2020). “Microsoft’s Efforts to Disrupt TrickBot”. Microsoft. Retrieved 2025-05-30. ↩︎