Adversary Intelligence — 2026-09-18

Trickbot Cybercrime Leader Wanted by Germany and EU-Sanctioned Exposed as Adviser to Russian Duma Deputy Speaker

BLUFKovalev's documented advisory role with a Duma deputy speaker reinforces assessed links between Russian cybercriminal networks and state structures, and his arrest or extradition remains very unlikely within twelve months.

Vitaly Kovalev, wanted by Germany's BKA as the alleged founder and leader of the Trickbot hacker group under the aliases Stern and Ben, served as an adviser to State Duma Deputy Speaker Vladislav Davankov for more than a year, according to Davankov's own August 2025 Telegram post and reporting by The Insider citing the GangExposed project 1. Davankov described Kovalev as a New People supporter, entrepreneur, and med-tech investor; the two visited a longevity laboratory at Volgograd State Medical University together 1. Kovalev was initially placed on New People's federal candidate list for the Duma but was removed from regional group No. 18 before the list's July 10 certification, per Vedomosti reporting cited by The Insider and Meduza 12. Interpol issued a Red Notice for Kovalev in May 2025 at Germany's request, and the EU Council added him to its sanctions list in July 2026 over Trickbot- and Conti-linked cyberattacks. iStories additionally reported that the U.S. Treasury has asserted a connection between Trickbot members and Russian intelligence services 13.

Analysis
Arrest, extradition, or custody of Kovalev by any government is very unlikely within the next twelve months, given Russia's lack of extradition treaties with Germany or EU states and his demonstrated proximity to Duma leadership. His quiet removal from New People's certified candidate list before the July 10 deadline reflects reputational damage control rather than any new physical-security exposure. Davankov's own August 2025 public endorsement, surfacing alongside EU sanctions and an Interpol Red Notice, points to either institutional vetting failure or tolerance reaching into party leadership. The disclosure's timing, coming right after Kovalev's ballot removal, also fits opposition-aligned kompromat aimed at embarrassing Davankov rather than organic investigative breakthrough. Confidence in this judgment is moderate, resting on a single investigative report reproduced by five outlets without independent confirmation of Kovalev's location or protection. Continued inaction would confirm Trickbot leadership remains beyond the reach of EU and German warrants absent formal Western extradition or asset-freeze action against a Duma-linked adviser.

6 sources