Russian hacker identified as alleged leader of Trickbot cybercrime syndicate

German authorities have identified Vitaly Nikolaevich Kovalev, a 36-year-old Russian national, as the alleged leader of the notorious Trickbot hacking group, according to a report published by Wired. Kovalev, known by the online alias “Stern,” has allegedly led the criminal organization responsible for stealing hundreds of millions of dollars over the past six years.

An Interpol red notice recently issued for Kovalev states that he is wanted in Germany on accusations of acting as the ringleader of a transnational cybercriminal enterprise. Despite these allegations, Kovalev remains in Russia, where he is currently shielded from extradition due to local legal protections.

The identification of Kovalev as Stern marks a significant development in the ongoing investigation into Trickbot, a cybercriminal group known for its sophisticated malware campaigns targeting financial institutions and infrastructure worldwide. Cybersecurity experts say the unmasking of Stern provides long-awaited clarity about the group’s leadership.

“Trickbot’s ‘big boss’ and one of the most noteworthy figures in the Russian cybercriminal underground, Stern remained an elusive character, and his real name was taboo for years,” said Alexander Leslie, a threat intelligence analyst at Recorded Future, in comments to Wired.

Although Kovalev had previously been sanctioned in 2023 by both the United States and the United Kingdom for his senior role in Trickbot, these actions did not connect him directly to the Stern alias. Prior to the recent revelation, authorities had linked him only to online monikers such as “ben” and “Bentley.” Kovalev has also faced charges related to a 2010 bank fraud case involving cyber intrusions, further anchoring his history in digital financial crimes.