EU Sanctions ‘Stern’ As Chainalysis Identifies $300M Trickbot Administrator Among Most Prolific Ransomware Operators On Record
In Brief
The US, EU and UK sanctioned hackers and cybercrime networks tied to ransomware, targeting actors linked to over $300 million in crypto ransom payments.
The United States, European Union, and United Kingdom have jointly sanctioned a network of nation-state hackers, cybercriminals, and infrastructure providers in one of the largest coordinated cyber enforcement actions to date, with blockchain analysis firm Chainalysis disclosing the financial scale of the targeted operations.
Announced on July 13, 2026, the action targets actors collectively responsible for billions of dollars in damages to businesses, critical infrastructure, and governments worldwide. Central to the designations is Vitaly Nikolayevich Kovalev, known as “Stern,” identified as the administrator of the Trickbot criminal syndicate — the group behind ransomware strains including Ryuk and Conti.
Wallets associated with Kovalev have received over $300 million in ransom payments, a figure Chainalysis notes represents only his personal share of proceeds, with the syndicate’s total haul being substantially larger. On-chain data shows Kovalev transacted with at least eight ransomware families. Leaked internal communications from the Conti group indicate he held a senior executive role, with authority over the syndicate’s budget, hiring, and operational planning. His EU designation brings the total number of sanctioned Trickbot members to 19, following US and UK actions against 18 members in 2023.
Designations Extend to Infrastructure and State-Linked Actors
The action also targets the infrastructure layer enabling cybercriminal operations. OFAC designated First VPN Service (1VPNS), a provider whose principal clients include ransomware actors, alongside its administrator Dmytro Rashevskyi and cryptor provider Yevgeniy Silayev. The designation followed a May 2026 law enforcement takedown of 1VPNS infrastructure conducted with FBI support. Associated cryptocurrency wallet addresses span multiple blockchains, including Bitcoin, Ethereum, Litecoin, TRON, and Solana.
EU designations covered a wider range of actors. These include the developers of LummaC2, a Malware-as-a-Service infostealer dismantled by the DOJ and Europol in May 2025, and bullet-proof hosting provider Media Land LLC, previously sanctioned by OFAC in November 2025. State-linked designations covered members of GRU Unit 29155, pro-Russia hacktivist groups CARR and Z-Pentest — the latter linked to attacks on energy and water infrastructure — and GRU officer Evgeniy Bashev, who coordinated the WhisperGate malware campaign against Ukrainian critical infrastructure.
Chainalysis confirmed that cryptocurrency addresses associated with the designations have been labeled across its compliance product suite to support institutional monitoring and sanctions screening.
Disclaimer
In line with the Trust Project guidelines, please note that the information provided on this page is not intended to be and should not be interpreted as legal, tax, investment, financial, or any other form of advice. It is important to only invest what you can afford to lose and to seek independent financial advice if you have any doubts. For further information, we suggest referring to the terms and conditions as well as the help and support pages provided by the issuer or advertiser. MetaversePost is committed to accurate, unbiased reporting, but market conditions are subject to change without notice.
About The Author
Alisa, a dedicated journalist at the MPost, specializes in crypto, AI, investments, and the expansive realm of Web3. With a keen eye for emerging trends and technologies, she delivers comprehensive coverage to inform and engage readers in the ever-evolving landscape of digital finance.
More articles
Alisa, a dedicated journalist at the MPost, specializes in crypto, AI, investments, and the expansive realm of Web3. With a keen eye for emerging trends and technologies, she delivers comprehensive coverage to inform and engage readers in the ever-evolving landscape of digital finance.
