Kovalev has been internationally wanted by Interpol since May 2025. A red notice has been issued for him — it is used to establish a person’s whereabouts and seek their arrest for extradition.
The search was initiated by Germany’s Federal Criminal Police Office (BKA). The German notice says that Kovalev is believed to be the founder of the cybercriminal group that created the TrickBot malware, and that he led it under the aliases Stern and Ben.
According to the BKA, Kovalev, as the “main perpetrator”, facilitated the continued use and improvement of the malware, which the group used to infiltrate other people’s computer systems and steal data. It also claims that TrickBot has been active since at least 2016, infected hundreds of thousands of computers in Germany and around the world, and illegally obtained hundreds of millions of euros.
According to these data, the victims included hospitals, government institutions, government agencies, and private individuals. During the COVID-19 pandemic, the group infected medical facilities in the United States with malware.
Because of this attack, computer and telephone communications were disrupted in three hospitals in Minnesota. The virus also redirected ambulances to the wrong addresses.
In August 2025, Vladislav Davankov wrote that Kovalev had already held the position of his adviser for more than a year. The State Duma deputy speaker called him “an entrepreneur, an investor in medtech, and a supporter of the New People party”.
Kovalev was also nominated for the State Duma elections by the New People party, but was later removed from the list, Vedomosti wrote. He is not on the registered CEC list, and Kovalev himself is under US, British, and European sanctions; the US Treasury says the group’s members are linked to Russian intelligence services.
Sources
