Vitaly Nikolayevich Kovalev
Sanctioned entityBorn 26 Jun 1988 (38 years old),Russia. Named in 9 sanctions listings.
Summary
In February 2012, a federal grand jury in the District of New Jersey returned an indictment charging Vitaly Nikolayevich Kovalev with conspiracy to commit bank fraud and eight counts of bank fraud in connection with a series of intrusions into victim bank accounts held at various U.S.-based financial institutions that occurred in 2009 and 2010.As alleged in the indictment, Kovalev and his co-conspirators were able to gain unauthorized access to accounts held at least three different U.S-based financial institutions. Once they gained access to the accounts, Kovalev and others made unauthorized transfers of funds into other bank accounts established by, and at the direction of, Kovalev solely for the purpose of receiving the stolen funds. The funds would then be withdrawn or transferred out of these accounts at the direction of Kovalev. In total, Kovalev and his co-conspirators were able to transfer without authorization nearly $1 million from the victim bank accounts.The prosecution is being handled by the U.S. Attorney’s Office in New Jersey. In addition to the criminal charges, the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) issued sanctions against Kovalev in relation to his position as a senior figure within the Trickbot trojan virus organization.The charges and allegations contained in the indictment are merely accusations, and the defendant is presumed innocent unless and until proven guilty.If you have information regarding this individual, please contact the U.S. Secret Service via email at MostWanted@usss.dhs.gov or via Signal at USSSMostWanted.1865.
The ‘Bentley’ alias is for historical use of the moniker. The Director Disqualification Sanction was imposed on 09/04/2025.
(also Vitaliy KOVALEV, Vitaliy KOVALEV)
(also Vitaly Nikolayevich KOVALEV)
Relevant links: /newsroom/releases/2023/02/russian-national-charged-bank-fraud-related-hacking-campaign, https://www.justice.gov/usao-nj/pr/russian-national-charged-bank-fraud-related-hacking-campaign, https://home.treasury.gov/news/press-releases/jy1256
Entités associées: TrickBot, Wizard Spider, Conti
Vitaly Kovalev is a senior figure in the malware programs “Trickbot” and “Conti”. He is also known by the online monikers “Bentley”, “Bergen”, “Alex Konor”, “Benny”, “Ben” and “Stern”. Conti and Trickbot were originally created and developed by Wizard Spider. Wizard Spider has conducted ransomware campaigns in a variety of sectors, including essential services such as health and banking, has infected computers worldwide and their malware has been developed into a highly modular malware suite. Campaigns by Wizard Spider, using malware such as Conti, and TrickBot, are responsible for substantial economic damage in the European Union. Vitaly Kovalev is therefore responsible for, and involved in, cyber-attacks with a significant effect which constitute an external threat to the Union or its Member States.
Senior member of Trickbot Group
(UE) 2026/1714 du 13/07/2026 (UE Cyberattaques - R (UE) 2019/796) (FondementJuridique: 4189)
Entités associées : TrickBot, Wizard Spider, Conti - Vitaly Kovalev est un personnage de premier plan dans les programmes malveillants “Trickbot” et “Conti”. Il est également connu par ses surnoms en ligne “Bentley”, “Bergen”, “Alex Konor”, “Benny”, “Ben” et “Stern”. À l'origine, Conti et TrickBot ont été créés et développés par Wizard Spider. Wizard Spider a mené des attaques par rançongiciel dans divers secteurs, y compris des services essentiels tels que la santé et le secteur bancaire, a infecté des ordinateurs dans le monde entier et son logiciel malveillant a été développé en une série de logiciels malveillants hautement modulaires. Les attaques menées par Wizard Spider, en utilisant des logiciels malveillants tels que Conti et TrickBot, sont responsables de préjudices économiques substantiels dans l'Union européenne. Par conséquent, Vitaly Kovalev est responsable de cyberattaques ayant des effets importants et constituant une menace extérieure pour l'Union ou pour ses États membres, et y participe.
Sanctions and listings9
- Listed
- 31 Oct 2024
- Effective
- 9 Feb 2023
Reciprocal
OFACUS SAM Procurement ExclusionsUnited StatesActive
Prohibition/Restriction
Redacted for Security Reasons
- Effective
- 9 Feb 2023
UK sanctions relating to cyber activity - The Cyber (Sanctions) (EU Exit) Regulations 2020
UK; Foreign, Commonwealth & Development OfficeUK FCDO Sanctions ListUnited Kingdom
Director Disqualification Sanction, travel ban and asset freeze
Vitaliy Nikolayevich KOVALEV is or has been involved in relevant cyber activity, including being responsible for, engaging in, providing support for, or promoting the commission, planning or preparation of relevant cyber activity; and providing technical assistance that could contribute to relevant cyber activity, namely ransomware attacks which were intended to undermine the integrity, prosperity and security of the United Kingdom and other countries, and were intended to cause economic loss to, or prejudice the commercial interests of, those companies affected by the activity.
Programme GB-CYBReference 15742Reference CYB0027Last updated 9 Apr 2025gov.ukgov.uk
- Listed
- 9 Feb 2023
Cyber-Related Sanctions - CYBER2
Office of Foreign Assets ControlUS OFAC Specially Designated Nationals (SDN) ListUnited States
CYBER2 and block
Executive Order 13757 (Cyber)
Programme US-CYBReference 40769treasury.govofac.treasury.gov
- Listed
- 31 Mar 2023
- Effective
- 9 Feb 2023
Reciprocal
OFACUS SAM Procurement ExclusionsUnited StatesActive
Prohibition/Restriction
Redacted for Security Reasons
INTERPOL Red Notices
INTERPOLINTERPOL Red NoticesGermany
Membership in a criminal organisation as the ringleader
Programme INTERPOL-RNReference 2025/39252interpol.intinterpol.int
- Effective
- 13 Jul 2026
EU Restrictive Measures Against Cyber-Attacks Threatening The Union Or Its Member States
Council of the European UnionEU Council Official Journal Sanctioned EntitiesEuropean Union
Programme EU-CYBdocs.google.comsanctionsmap.eu
EU Restrictive Measures Against Cyber-Attacks Threatening The Union Or Its Member States - (UE) 2026/1714 du 13/07/2026 (UE Cyberattaques - R (UE) 2019/796)
Direction Générale du TrésorFrench National Asset Freezing SystemFrance
Entités associées : TrickBot, Wizard Spider, Conti - Vitaly Kovalev est un personnage de premier plan dans les programmes malveillants “Trickbot” et “Conti”. Il est également connu par ses surnoms en ligne “Bentley”, “Bergen”, “Alex Konor”, “Benny”, “Ben” et “Stern”. À l'origine, Conti et TrickBot ont été créés et développés par Wizard Spider. Wizard Spider a mené des attaques par rançongiciel dans divers secteurs, y compris des services essentiels tels que la santé et le secteur bancaire, a infecté des ordinateurs dans le monde entier et son logiciel malveillant a été développé en une série de logiciels malveillants hautement modulaires. Les attaques menées par Wizard Spider, en utilisant des logiciels malveillants tels que Conti et TrickBot, sont responsables de préjudices économiques substantiels dans l'Union européenne. Par conséquent, Vitaly Kovalev est responsable de cyberattaques ayant des effets importants et constituant une menace extérieure pour l'Union ou pour ses États membres, et y participe.
Programme EU-CYBgels-avoirs.dgtresor.gouv.frsanctionsmap.eu
Official designation
La Principauté de MonacoMonaco National Fund Freezing ListMonaco
(UE) 2026/1714 du 13/07/2026
Autorité de désignation publiée : Union européenne
Vitaly Kovalev est un personnage de premier plan dans les programmes malveillants “Trickbot” et “Conti”. Il est également connu par ses surnoms en ligne “Bentley”, “Bergen”, “Alex Konor”, “Benny”, “Ben” et “Stern”. À l'origine, Conti et TrickBot ont été créés et développés par Wizard Spider. Wizard Spider a mené des attaques par rançongiciel dans divers secteurs, y compris des services essentiels tels que la santé et le secteur bancaire, a infecté des ordinateurs dans le monde entier et son logiciel malveillant a été développé en une série de logiciels malveillants hautement modulaires. Les attaques menées par Wizard Spider, en utilisant des logiciels malveillants tels que Conti et TrickBot, sont responsables de préjudices économiques substantiels dans l'Union européenne. Par conséquent, Vitaly Kovalev est responsable de cyberattaques ayant des effets importants et constituant une menace extérieure pour l'Union ou pour ses États membres, et y participe.
- Effective
- 12 Sep 2025
Russia Sanctions Act 2022
Ministry of Foreign Affairs and TradeNew Zealand Russia SanctionsNew ZealandSanctioned
Aircraft Ban, travel ban, service prohibition, dealing with securities, asset freeze and ship ban
Malicious Russian Cyber Actor, undermining of Ukraine’s sovereignty and territorial integrity
Programme NZ-RSA2022mfat.govt.nz
Connections3
Other links3
- Linked from
- Linked from
- Linked from
Other names21
Also known as15
Weak aliases6
Spellings the source flags as too generic to establish a match on their own.
Addresses7
Serebristy Bulvar 34 (SerebristyyBul'var), krp 1, flt 528, 197341, Saint-Pétersbourg
197341
Serebristy Bulvar 34 (Serebristyy Bul’var)
flt 528
Serebristy Bulvar 34 (Serebristyy Bul'var), krp 1, flt 528, 197341, Saint-Pétersbourg, Fédération de Russie
krp 1
St Petersburg, Russian Federation
This page shows the public record as its publishers state it. A name here is not by itself a finding: whether a record refers to a particular person or company is what screening decides. Read the full notice.