Close Menu
Best in TechnologyBest in Technology
  • News
  • Phones
  • Laptops
  • Gadgets
  • Gaming
  • AI
  • Tips
  • More
    • Web Stories
    • Global
    • Press Release

Subscribe to Updates

Get the latest tech news and updates directly to your inbox.

What's On

What Do Kids Actually Think About AI?

18 August 2025

The Plan to Turn the Caribbean’s Glut of Sargassum Into Biofuel

18 August 2025

AI Is Designing Bizarre New Physics Experiments That Actually Work

17 August 2025
Facebook X (Twitter) Instagram
Just In
  • What Do Kids Actually Think About AI?
  • The Plan to Turn the Caribbean’s Glut of Sargassum Into Biofuel
  • AI Is Designing Bizarre New Physics Experiments That Actually Work
  • Pebblebee Is Getting Serious About Personal Safety Tracking
  • Review: Camp Snap CS-8
  • What Is the Electric Constant and Why Should You Care?
  • WIRED’s Guide to Buying a Used Plug-In Hybrid
  • The Best Back-to-School Deals on Gadgets and Dorm Gear
Facebook X (Twitter) Instagram Pinterest Vimeo
Best in TechnologyBest in Technology
  • News
  • Phones
  • Laptops
  • Gadgets
  • Gaming
  • AI
  • Tips
  • More
    • Web Stories
    • Global
    • Press Release
Subscribe
Best in TechnologyBest in Technology
Home » Cops in Germany Claim They’ve ID’d the Mysterious Trickbot Ransomware Kingpin
News

Cops in Germany Claim They’ve ID’d the Mysterious Trickbot Ransomware Kingpin

News RoomBy News Room30 May 20254 Mins Read
Share Facebook Twitter Pinterest LinkedIn Tumblr Reddit Telegram Email
Share
Facebook Twitter LinkedIn Pinterest Email

Several cybersecurity researchers who have tracked Trickbot extensively tell WIRED they were unaware of the announcement. An anonymous account on the social media platform X recently claimed that Kovalev used the Stern handle and published alleged details about him. WIRED messaged multiple accounts that supposedly belong to Kovalev, according to the X account and a database of hacked and leaked records compiled by District 4 Labs but received no response.

Meanwhile, Kovalev’s name and face may already be surprisingly familiar to those who have been following recent Trickbot revelations. This is because Kovalev was jointly sanctioned by the United States and United Kingdom in early 2023 for his alleged involvement as a senior member in Trickbot. He was also charged in the US at the time with hacking linked to bank fraud allegedly committed in 2010. The US added him to its most wanted list. In all of this activity, though, the US and UK linked Kovalev to the online handles “ben” and “Bentley.” The 2023 sanctions did not mention a connection to the Stern handle. And, in fact, Kovalev’s 2023 indictment was mainly noteworthy because his use of “Bentley” as a handle was determined to be “historic” and distinct from that of another key Trickbot member who also went by “Bentley.”

The Trickbot ransomware group first emerged around 2016, after its members moved from the Dyre malware that was disrupted by Russian authorities. Over the course of its lifespan, the Trickbot group—which used its namesake malware, alongside other ransomware variants such as Ryuk, IcedID, and Diavol—increasingly overlapped in operations and personnel with the Conti gang. In early 2022, Conti published a statement backing Russia’s full-scale invasion of Ukraine, and a cybersecurity researcher who had infiltrated the groups leaked more than 60,000 messages from Trickbot and Conti members, revealing a huge trove of information about their day-to-day operations and structure.

Stern acted like a “CEO” of the Trickbot and Conti groups and ran them like a legitimate company, leaked chat messages analyzed by WIRED and security researchers show.

“Trickbot set the mold for the modern ‘as-a-service’ cybercriminal business model that was adopted by countless groups that followed,” Recorded Future’s Leslie says. “While there were certainly organized groups that preceded Trickbot, Stern oversaw a period of Russian cybercrime that was characterized by a high level of professionalization. This trend continues today, is reproduced worldwide, and is visible in most active groups on the dark web.”

Stern’s eminence within Russian cybercrime has been widely documented. The cryptocurrency tracing firm Chainalysis does not publicly name cybercriminal actors and declined to comment on BKA’s identification, but the company emphasized that the Stern persona alone is one of the all-time most profitable ransomware actors it tracks.

“The investigation revealed that stern generated significant revenues from illegal activities, in particular in connection with ransomware,” the BKA spokesperson tells WIRED.

Stern “surrounds himself with very technical people, many of which he claims to have sometimes decades of experience, and he’s willing to delegate substantial tasks to these experienced people whom he trusts,” says Keith Jarvis, a senior security researcher at cybersecurity firm Sophos’ Counter Threat Unit. “I think he’s always probably lived in that organizational role.”

Increasing evidence in recent years has indicated that Stern has at least some loose connections to Russia’s intelligence apparatus, including its main security agency, the Federal Security Service (FSB). The Stern handle mentioned setting up an office for “government topics” in July 2020, while researchers have seen other members of the Trickbot group say that Stern is likely the “the link between us and the ranks/head of department type at FSB.”

Stern’s consistent presence was a significant contributor to Trickbot and Conti’s effectiveness—as was the entity’s ability to maintain strong operational security and remain hidden.

As Sophos’ Jarvis put it, “I have no thoughts on the attribution as I’ve never heard a compelling story about Stern’s identity from anyone prior to this announcement.”

Share. Facebook Twitter Pinterest LinkedIn Tumblr Email
Previous ArticleTecno Spark Go (2023) – Price in India, Specifications, Comparison (30th May 2025)
Next Article Special Death Stranding 2: On The Beach Live Event Will Feature Kojima, New Gameplay, And More

Related Articles

News

What Do Kids Actually Think About AI?

18 August 2025
News

The Plan to Turn the Caribbean’s Glut of Sargassum Into Biofuel

18 August 2025
News

AI Is Designing Bizarre New Physics Experiments That Actually Work

17 August 2025
News

Pebblebee Is Getting Serious About Personal Safety Tracking

17 August 2025
News

Review: Camp Snap CS-8

17 August 2025
News

What Is the Electric Constant and Why Should You Care?

17 August 2025
Demo
Top Articles

ChatGPT o1 vs. o1-mini vs. 4o: Which should you use?

15 December 2024105 Views

Costco partners with Electric Era to bring back EV charging in the U.S.

28 October 202495 Views

Every iPhone release in chronological order: 2007-2024

29 January 202486 Views

Subscribe to Updates

Get the latest tech news and updates directly to your inbox.

Latest News
News

What Is the Electric Constant and Why Should You Care?

News Room17 August 2025
News

WIRED’s Guide to Buying a Used Plug-In Hybrid

News Room16 August 2025
News

The Best Back-to-School Deals on Gadgets and Dorm Gear

News Room16 August 2025
Most Popular

The Spectacular Burnout of a Solar Panel Salesman

13 January 2025129 Views

ChatGPT o1 vs. o1-mini vs. 4o: Which should you use?

15 December 2024105 Views

Costco partners with Electric Era to bring back EV charging in the U.S.

28 October 202495 Views
Our Picks

Pebblebee Is Getting Serious About Personal Safety Tracking

17 August 2025

Review: Camp Snap CS-8

17 August 2025

What Is the Electric Constant and Why Should You Care?

17 August 2025

Subscribe to Updates

Get the latest tech news and updates directly to your inbox.

Facebook X (Twitter) Instagram Pinterest
  • Privacy Policy
  • Terms of use
  • Advertise
  • Contact Us
© 2025 Best in Technology. All Rights Reserved.

Type above and press Enter to search. Press Esc to cancel.