The European Union sanctions Stern, "the most active ransomware operator in history," involving over $300 million in ransom payments.

ChainCatcher reports that the United States, European Union, and United Kingdom have jointly announced sanctions against a group of state-sponsored hacker organizations, cybercriminal gangs, and their infrastructure providers. The targeted entities have allegedly caused billions of dollars in losses to global businesses, critical infrastructure, and government agencies. The most notable is the EU’s sanction against Russian cybercriminal Vitaly Nikolayevich Kovalev (alias “Stern”).

The EU identifies Stern as one of the core managers of the notorious Trickbot Group ransomware syndicate, which includes high-risk ransomware variants such as Conti ransomware and Ryuk. On-chain analysis shows that wallet addresses linked to Stern have cumulatively received over $300 million in ransom payments, possibly making him the largest confirmed ransomware operator to date. It is believed that the $300 million only reflects Stern’s personal earnings, and the overall illegal revenue of the Trickbot Group could be much higher.

On-chain fund flows indicate that Stern has had transactional connections with multiple ransomware ecosystems, including Ryuk, Conti, Diavol, Karakurt, Royal, and Quantum. Investigations reveal that Stern played a “CEO”–like role within the Trickbot organization, responsible for budget management, personnel recruitment, infrastructure procurement, and attack planning.