Vitaly Kovalev, a man wanted by German authorities for allegedly leading the Trickbot cybercriminal group, previously served as an adviser to a Russian State Duma Deputy Speaker.

Vitaly Kovalev, identified by German investigators as the alleged founder and leader of the Trickbot cybercriminal group, worked as an adviser to Russian State Duma Deputy Speaker Vladislav Davankov. German authorities have issued an international arrest warrant and an Interpol Red Notice for Kovalev, who is believed to be in Russia. The connection between Kovalev and the State Duma official was initially highlighted by the GangExposed project.

Advisory Role and Political Activity

In August 2025, Vladislav Davankov confirmed that Kovalev had served as his adviser for over a year, characterizing him as an entrepreneur and medical technology investor. Davankov stated that Kovalev was tasked with promoting products from the Volgograd State Medical University. Kovalev was also nominated as a candidate for the State Duma on the New People party ticket, though he was later removed from the party's registered list before the final certification by the Central Election Commission.

German Criminal Allegations

Germany’s Federal Criminal Police Office (BKA) alleges that Kovalev, who uses multiple aliases including 'Stern' and 'Ben,' led the Trickbot group since at least 2016. The group is accused of infecting hundreds of thousands of computer systems globally using various malware tools, including Ryuk and Conti, to generate hundreds of millions of euros. These activities targeted hospitals, government agencies, and private companies.