EU Sanctions Ransomware Operator Stern, Involved in Over $300 Million Ransom Payments

The United States, European Union, and the United Kingdom jointly announced sanctions against state-sponsored hacking organizations and cybercriminal groups, focusing on Russian cybercriminal Vitaly Nikolayevich Kovalev (alias "Stern"). The EU has identified Stern as one of the core managers of the Trickbot Group ransomware organization, which is involved in several high-risk ransomware variants, including Conti ransomware and Ryuk. On-chain analysis shows that wallet addresses associated with Stern have received over $300 million in ransom payments, making him one of the confirmed "largest ransomware operators". The $300 million only represents Stern's personal earnings, while the overall illegal income of the Trickbot group may be even higher. The flow of funds indicates that Stern has transactional links with multiple ransomware ecosystems, including Ryuk, Conti, Diavol, Karakurt, Royal, and Quantum. Investigations reveal that Stern plays a role similar to that of a "CEO" within the Trickbot organization, responsible for budget management, personnel recruitment, infrastructure procurement, and attack planning.