US, UK and EU Sanction Trickbot Figure “Stern” and Other Cybercrime Enablers
Summary
The US, UK and EU announced sanctions against cybercriminals and enablers, including Trickbot administrator Vitaly Kovalev (“Stern”), whose associated wallets received over $300 million in ransom payments.
Key points
- The EU designated Vitaly Kovalev, known as “Stern,” a senior Trickbot figure linked to Ryuk and Conti; associated wallets received more than $300 million in ransom payments.
- OFAC designated VPN provider First VPN Service (1VPNS), its administrator Dmytro Rashevskyi, and cryptor provider Yevgeniy Silayev for enabling ransomware attacks.
- The EU also designated LummaC2 developers, bullet-proof hosting provider Media Land LLC and its owner, and actors linked to GRU Unit 29155, CARR, and Z-Pentest.
- European law enforcement, with FBI support, took down 1VPNS’s website and infrastructure in May 2026. LummaC2 was disrupted in a coordinated operation beginning in May 2025.
- The sanctions target infrastructure and service providers as well as cyber operators, including VPN, malware-as-a-service, hosting, and cryptor services.
Article Details
- Event Type
- International sanctions targeting nation-state cyber actors, cybercriminals, and infrastructure providers.
- Impact
- The United States, United Kingdom, and European Union announced designations targeting ransomware operators and enablers, including Vitaly Nikolayevich Kovalev (“Stern”), First VPN Service (1VPNS) and associated individuals, and entities linked to LummaC2, Media Land LLC, and Russian state-linked cyber activity. The article says wallets associated with Stern received more than $300 million in ransom payments; it describes this as a potentially record-setting amount and notes that the figure represents only his personal share.
People
Alexander Alexandrovich VolosovikIdentified as the owner of Media Land LLC, a bullet-proof hosting provider that facilitated ransomware operations.Dmytro RashevskyiAdministrator of First VPN Service (1VPNS), designated by OFAC for enabling ransomware attacks.Evgeniy Viktorovich BASHEVIdentified as a member of Russian military intelligence agency GRU, Unit 29155; facilitated infrastructure and payments, coordinated collaboration with external hacker networks, and facilitated the WhisperGate campaign targeting Ukrainian critical infrastructure.Maksim Aleksandrovich GordienkoIdentified as a developer of the LummaC2 infostealer.Maksim Evgenevich VoroninIdentified as a developer of the LummaC2 infostealer.Vitaly Nikolayevich KovalevEU-designated Russian national described as a senior Trickbot Group figure and administrator of its ransomware operations; also known as “Stern.”Yevgeniy Vladimirovich SilayevIdentified as a cryptor provider and designated by OFAC for enabling ransomware attacks; the article’s FAQ refers to him as Yevgeniy Silayev.
Threat Actors
BlackBastaRansomware operation that the article says Media Land LLC facilitated.CARRAcronym for Cyber Army of Russia Reborn, which the article describes as conducting cyber-attacks against critical infrastructure in EU member states and Ukraine.Cyber Army of Russia RebornPro-Russia hacktivist group described as conducting cyber-attacks against critical infrastructure in EU member states and Ukraine; the article identifies it as CARR.EvilCorpRansomware operation that the article says Media Land LLC facilitated.GRU Unit 29155Russian state-linked unit whose members were included in the EU designations; the article says a member facilitated the WhisperGate campaign targeting Ukrainian critical infrastructure.LockBitRansomware operation that the article says Media Land LLC facilitated.Trickbot GroupCybercriminal group described as conducting ransomware campaigns against essential services, including healthcare and banking.Z-PentestPro-Russia hacktivist group with ties to CARR; described as targeting critical infrastructure in the energy and water sectors.
Malware
3amAs the Chainalysis Reactor graph below shows, Stern transacted with numerous ransomware strains, including Ryuk, Conti, Diavol, Karakurt, Royal, 3am, Quantum, and Bitpaymer.BitpaymerAs the Chainalysis Reactor graph below shows, Stern transacted with numerous ransomware strains, including Ryuk, Conti, Diavol, Karakurt, Royal, 3am, Quantum, and Bitpaymer.Contiof the Trickbot criminal syndicate behind some of the most notorious ransomware strains, including Conti. Kovalev was first designated by the U.S. Office of the Treasury’s Office of Foreign Assets Control (OFAC)DiavolAs the Chainalysis Reactor graph below shows, Stern transacted with numerous ransomware strains, including Ryuk, Conti, Diavol, Karakurt, Royal, 3am, Quantum, and Bitpaymer.KarakurtAs the Chainalysis Reactor graph below shows, Stern transacted with numerous ransomware strains, including Ryuk, Conti, Diavol, Karakurt, Royal, 3am, Quantum, and Bitpaymer.LummaC2The EU also designated individuals and entities linked to LummaC2 infostealer malware, bullet-proof hosting provider Media Land LLC, Russian GRU Unit 29155, and pro-Russia hacktivist groups CARR and Z-Pentest.QuantumAs the Chainalysis Reactor graph below shows, Stern transacted with numerous ransomware strains, including Ryuk, Conti, Diavol, Karakurt, Royal, 3am, Quantum, and Bitpaymer.RoyalAs the Chainalysis Reactor graph below shows, Stern transacted with numerous ransomware strains, including Ryuk, Conti, Diavol, Karakurt, Royal, 3am, Quantum, and Bitpaymer.Ryukmost notably “Stern.” According to the EU, Kovalev is a senior figure of the Trickbot Group, including Ryuk and Conti ransomware and its many offshoots — among the most destructive malware programs in recentTrickBotThe EU designated Vitaly Nikolayevich Kovalev, also known as “Stern,” administrator of the Trickbot ransomware operations who has received more than $300 million in ransom payments.WhisperGatepayments, and coordinated GRU’s collaboration with “external hacker networks.” Bashev facilitated the WhisperGate malware campaign targeting Ukrainian critical infrastructure, which notably sent an extortion demand in
Vendors
First VPN Service (1VPNS)In a separate action, OFAC designated First VPN Service (1VPNS), its administrator Dmytro Rashevskyi, and cryptor provider, Yevgeniy Silayev, for enabling ransomware attacks.Media Land LLCThe EU also designated individuals and entities linked to LummaC2 infostealer malware, bullet-proof hosting provider Media Land LLC, Russian GRU Unit 29155, and pro-Russia hacktivist groups CARR and Z-Pentest.
Products
Countries
RussiaThe EU also designated individuals and entities linked to LummaC2 infostealer malware, bullet-proof hosting provider Media Land LLC, Russian GRU Unit 29155, and pro-Russia hacktivist groups CARR and Z-Pentest.UkraineRussian state-linked actors including members of GRU Unit 29155 and the Cyber Army of Russia Reborn (CARR), which have conducted cyber-attacks against critical infrastructure in EU member states and Ukraine.
Industries
Bankinggroup that has conducted ransomware campaigns across essential services including healthcare and banking.EnergyThe EU also designated Z-Pentest, a pro-Russia hacktivist group with ties to CARR that has targeted critical infrastructure in the energy and water sectors, including a Danish water utility in December 2024.Healthcareis a cybercriminal group that has conducted ransomware campaigns across essential services including healthcare and banking.waterThe EU also designated Z-Pentest, a pro-Russia hacktivist group with ties to CARR that has targeted critical infrastructure in the energy and water sectors, including a Danish water utility in December 2024.