EU sanctions on Stern,"the most active ransomware operator in history", involving more than $300 million in ransom inflows

The United States, the European Union and the United Kingdom jointly announced sanctions against a number of national-level hacker organizations, cybercriminal gangs and their infrastructure providers. The target targets are accused of causing billions of dollars in losses to global companies, critical infrastructure and government agencies. Among them, the most concerned is the European Union's sanctions on Russian cybercriminal VitalyNikolayevich Kovalev (pseudonym "Stern"). The European Union has determined that Stern is one of the core managers of the notorious Trickbot Group ransomware group, which includes multiple high-risk ransomware variants such as Contiransomware and Ryuk. On-chain analysis shows that wallet addresses associated with Stern have received more than $300 million in ransom, potentially making it the "largest ransomware operator" confirmed to date. According to analysis, US$300 million only represents the income earned by Stern personally, and the overall illegal income of the Trickbot Group may be much higher than this. The flow of funds on the chain shows that Stern has had transactions with multiple ransomware ecosystems such as Ryuk, Conti, Diavol, Karakurt, Royal, and Quantum. Surveys show that Stern plays a similar role as a "CEO" within the Trickbot organization, responsible for budget management, personnel recruitment, infrastructure procurement, and attack planning.