German police link Russian party's former Duma candidate to Trickbot hacker group
Germany's Federal Criminal Police Office believes Vitaly Kovalev, briefly a State Duma candidate for the New People party, founded the Trickbot hacking group whose ransomware hit U.S. hospitals in 2020. Interpol wants Kovalev for organizing a criminal enterprise.
Russia's New People party had placed 38-year-old Vitaly Kovalev, who is wanted by Interpol for organizing a criminal enterprise, on its federal candidate list for the State Duma elections. He was initially assigned to regional group No. 18, covering Kalmykia and the Volgograd and Astrakhan regions, but was removed from the list before the Central Election Commission certified the candidate lists in July.
U.S. charges since 2012
Kovalev has faced U.S. charges since 2012 for conspiracy to commit bank fraud and unauthorized access to bank accounts, tied to the activities of the Trickbot hacking group. According to the U.S. Secret Service, Kovalev and his accomplices gained access to accounts at least three American financial institutions and illegally transferred nearly $1 million from them. In 2020, at the height of the pandemic, Trickbot carried out mass ransomware attacks on the U.S. health care system, infecting American hospitals and medical facilities.
German police suspicions
Germany's Federal Criminal Police Office suspects that Kovalev, as the founder of the hacking group behind the Trickbot malware, made a substantial contribution to carrying out global cyberattacks. Interpol's wanted persons database lists him as the organizer of a criminal enterprise.
As of at least 2025, Kovalev has served as an adviser to Vladislav Davankov, a State Duma deputy speaker from New People, who mentioned him on his Telegram channel. In August 2025, Davankov wrote that he had visited the longevity laboratory at Volgograd State Medical University together with "entrepreneur and medical technology investor Vitaly Kovalev, who has been my adviser for more than a year now."
