The BKA is seeking Kovalyov, born June 23, 1988, who German investigators believe founded and led Trickbot under the aliases Stern and Ben. Other aliases listed in the wanted notice include Grave, Vincent, Bentley, Bergen and Alex Konor. The BKA believes Kovalyov is in Russia.
The link between Kovalyov and Davankov was flagged by the project GangExposed. Davankov himself wrote in his Telegram channel in August 2025 that Kovalyov had been his adviser "for more than a year." Davankov described him as a supporter of the New People party, an entrepreneur and an investor in medical technology.
The two visited a longevity laboratory at Volgograd State Medical University, and according to Davankov, Kovalyov was to handle promotion of the university's developments in the region. Davankov's post was reposted by the university's official channel.
New People nominated Kovalyov as part of its federal party list for the State Duma elections. When the list was certified on July 10, Vedomosti reported that he had been removed from regional group No. 18, which included Kalmykia, the Astrakhan and Volgograd regions. The list then contained 298 candidates. Kovalyov does not appear on the final list registered by the Central Election Commission.
According to the BKA, Trickbot operated at least since 2016 and at various times counted more than 100 members. Its infrastructure was used not only for the malware of the same name but also for Bazarloader, SystemBC, IcedID, Ryuk, Conti and Diavol. The group infected hundreds of thousands of computer systems worldwide and earned hundreds of millions of euros from criminal activity. Its victims included hospitals, government agencies, companies and private individuals.
In May 2025, German authorities obtained international arrest warrants for members of cybercrime groups under Operation Endgame. The BKA said warrants were issued for 20 suspects. A red notice has also been published for Kovalyov through Interpol - a request to law enforcement agencies in other countries to locate a person and, if possible, temporarily detain them pending an extradition decision.
In July 2026, the EU Council added Kovalyov to its sanctions list over cyberattacks. The document lists his full name, date of birth and the aliases Bentley, Bergen, Alex Konor, Benny, Ben and Stern. The EU describes him as a senior figure linked to the Trickbot and Conti malware and holds him responsible for cyberattacks that caused significant economic damage.
The U.S. Justice Department has said Trickbot infected millions of computers, including at hospitals, schools and companies, and that its infrastructure was used to distribute Conti. According to the U.S. Justice Department, Conti was used in more than a thousand attacks worldwide, and ransoms paid by victims exceeded $150 million. The group's targets included medical facilities and emergency services.
The FBI recorded at least 16 Conti attacks on U.S. medical and emergency networks, including ambulance services, police and 911 dispatch centers. By that time, more than 400 organizations worldwide had been affected by Conti. Materials from U.S. Senate hearings state that more than 200 attacks using Ryuk, closely tied to the Trickbot and Conti ecosystem, led to nearly $100 million in lost revenue for medical organizations and roughly $500 million in system recovery costs.