Person

Vitaly Nikolayevich Kovalev

Sanctioned entity

Born 26 Jun 1988 (38 years old),Russia. Named in 9 sanctions listings.

Screen this subject

Summary

In February 2012, a federal grand jury in the District of New Jersey returned an indictment charging Vitaly Nikolayevich Kovalev with conspiracy to commit bank fraud and eight counts of bank fraud in connection with a series of intrusions into victim bank accounts held at various U.S.-based financial institutions that occurred in 2009 and 2010.As alleged in the indictment, Kovalev and his co-conspirators were able to gain unauthorized access to accounts held at least three different U.S-based financial institutions. Once they gained access to the accounts, Kovalev and others made unauthorized transfers of funds into other bank accounts established by, and at the direction of, Kovalev solely for the purpose of receiving the stolen funds. The funds would then be withdrawn or transferred out of these accounts at the direction of Kovalev. In total, Kovalev and his co-conspirators were able to transfer without authorization nearly $1 million from the victim bank accounts.The prosecution is being handled by the U.S. Attorney’s Office in New Jersey. In addition to the criminal charges, the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) issued sanctions against Kovalev in relation to his position as a senior figure within the Trickbot trojan virus organization.The charges and allegations contained in the indictment are merely accusations, and the defendant is presumed innocent unless and until proven guilty.If you have information regarding this individual, please contact the U.S. Secret Service via email at MostWanted@usss.dhs.gov or via Signal at USSSMostWanted.1865.

The ‘Bentley’ alias is for historical use of the moniker. The Director Disqualification Sanction was imposed on 09/04/2025.

(also Vitaliy KOVALEV, Vitaliy KOVALEV)

(also Vitaly Nikolayevich KOVALEV)

Relevant links: /newsroom/releases/2023/02/russian-national-charged-bank-fraud-related-hacking-campaign, https://www.justice.gov/usao-nj/pr/russian-national-charged-bank-fraud-related-hacking-campaign, https://home.treasury.gov/news/press-releases/jy1256

Entités associées: TrickBot, Wizard Spider, Conti

Vitaly Kovalev is a senior figure in the malware programs “Trickbot” and “Conti”. He is also known by the online monikers “Bentley”, “Bergen”, “Alex Konor”, “Benny”, “Ben” and “Stern”. Conti and Trickbot were originally created and developed by Wizard Spider. Wizard Spider has conducted ransomware campaigns in a variety of sectors, including essential services such as health and banking, has infected computers worldwide and their malware has been developed into a highly modular malware suite. Campaigns by Wizard Spider, using malware such as Conti, and TrickBot, are responsible for substantial economic damage in the European Union. Vitaly Kovalev is therefore responsible for, and involved in, cyber-attacks with a significant effect which constitute an external threat to the Union or its Member States.

Senior member of Trickbot Group

(UE) 2026/1714 du 13/07/2026 (UE Cyberattaques - R (UE) 2019/796) (FondementJuridique: 4189)

Entités associées : TrickBot, Wizard Spider, Conti - Vitaly Kovalev est un personnage de premier plan dans les programmes malveillants “Trickbot” et “Conti”. Il est également connu par ses surnoms en ligne “Bentley”, “Bergen”, “Alex Konor”, “Benny”, “Ben” et “Stern”. À l'origine, Conti et TrickBot ont été créés et développés par Wizard Spider. Wizard Spider a mené des attaques par rançongiciel dans divers secteurs, y compris des services essentiels tels que la santé et le secteur bancaire, a infecté des ordinateurs dans le monde entier et son logiciel malveillant a été développé en une série de logiciels malveillants hautement modulaires. Les attaques menées par Wizard Spider, en utilisant des logiciels malveillants tels que Conti et TrickBot, sont responsables de préjudices économiques substantiels dans l'Union européenne. Par conséquent, Vitaly Kovalev est responsable de cyberattaques ayant des effets importants et constituant une menace extérieure pour l'Union ou pour ses États membres, et y participe.

Sanctions and listings9

  • Listed
    31 Oct 2024
    Effective
    9 Feb 2023

    Reciprocal

    OFACUS SAM Procurement ExclusionsUnited StatesActive

    Prohibition/Restriction

    Redacted for Security Reasons

    sam.gov

  • Effective
    9 Feb 2023

    UK sanctions relating to cyber activity - The Cyber (Sanctions) (EU Exit) Regulations 2020

    UK; Foreign, Commonwealth & Development OfficeUK FCDO Sanctions ListUnited Kingdom

    Director Disqualification Sanction, travel ban and asset freeze

    Vitaliy Nikolayevich KOVALEV is or has been involved in relevant cyber activity, including being responsible for, engaging in, providing support for, or promoting the commission, planning or preparation of relevant cyber activity; and providing technical assistance that could contribute to relevant cyber activity, namely ransomware attacks which were intended to undermine the integrity, prosperity and security of the United Kingdom and other countries, and were intended to cause economic loss to, or prejudice the commercial interests of, those companies affected by the activity.

    Programme GB-CYBReference 15742Reference CYB0027Last updated 9 Apr 2025gov.ukgov.uk

  • Listed
    9 Feb 2023

    Cyber-Related Sanctions - CYBER2

    Office of Foreign Assets ControlUS OFAC Specially Designated Nationals (SDN) ListUnited States

    CYBER2 and block

    Executive Order 13757 (Cyber)

    Programme US-CYBReference 40769treasury.govofac.treasury.gov

  • Listed
    31 Mar 2023
    Effective
    9 Feb 2023

    Reciprocal

    OFACUS SAM Procurement ExclusionsUnited StatesActive

    Prohibition/Restriction

    Redacted for Security Reasons

    sam.gov

  • INTERPOL Red Notices

    INTERPOLINTERPOL Red NoticesGermany

    Membership in a criminal organisation as the ringleader

    Programme INTERPOL-RNReference 2025/39252interpol.intinterpol.int

  • Effective
    13 Jul 2026

    EU Restrictive Measures Against Cyber-Attacks Threatening The Union Or Its Member States

    Council of the European UnionEU Council Official Journal Sanctioned EntitiesEuropean Union

    Programme EU-CYBdocs.google.comsanctionsmap.eu

  • EU Restrictive Measures Against Cyber-Attacks Threatening The Union Or Its Member States - (UE) 2026/1714 du 13/07/2026 (UE Cyberattaques - R (UE) 2019/796)

    Direction Générale du TrésorFrench National Asset Freezing SystemFrance

    Entités associées : TrickBot, Wizard Spider, Conti - Vitaly Kovalev est un personnage de premier plan dans les programmes malveillants “Trickbot” et “Conti”. Il est également connu par ses surnoms en ligne “Bentley”, “Bergen”, “Alex Konor”, “Benny”, “Ben” et “Stern”. À l'origine, Conti et TrickBot ont été créés et développés par Wizard Spider. Wizard Spider a mené des attaques par rançongiciel dans divers secteurs, y compris des services essentiels tels que la santé et le secteur bancaire, a infecté des ordinateurs dans le monde entier et son logiciel malveillant a été développé en une série de logiciels malveillants hautement modulaires. Les attaques menées par Wizard Spider, en utilisant des logiciels malveillants tels que Conti et TrickBot, sont responsables de préjudices économiques substantiels dans l'Union européenne. Par conséquent, Vitaly Kovalev est responsable de cyberattaques ayant des effets importants et constituant une menace extérieure pour l'Union ou pour ses États membres, et y participe.

    Programme EU-CYBgels-avoirs.dgtresor.gouv.frsanctionsmap.eu

  • Official designation

    La Principauté de MonacoMonaco National Fund Freezing ListMonaco

    (UE) 2026/1714 du 13/07/2026

    Autorité de désignation publiée : Union européenne

    Vitaly Kovalev est un personnage de premier plan dans les programmes malveillants “Trickbot” et “Conti”. Il est également connu par ses surnoms en ligne “Bentley”, “Bergen”, “Alex Konor”, “Benny”, “Ben” et “Stern”. À l'origine, Conti et TrickBot ont été créés et développés par Wizard Spider. Wizard Spider a mené des attaques par rançongiciel dans divers secteurs, y compris des services essentiels tels que la santé et le secteur bancaire, a infecté des ordinateurs dans le monde entier et son logiciel malveillant a été développé en une série de logiciels malveillants hautement modulaires. Les attaques menées par Wizard Spider, en utilisant des logiciels malveillants tels que Conti et TrickBot, sont responsables de préjudices économiques substantiels dans l'Union européenne. Par conséquent, Vitaly Kovalev est responsable de cyberattaques ayant des effets importants et constituant une menace extérieure pour l'Union ou pour ses États membres, et y participe.

    geldefonds.gouv.mc

  • Effective
    12 Sep 2025

    Russia Sanctions Act 2022

    Ministry of Foreign Affairs and TradeNew Zealand Russia SanctionsNew ZealandSanctioned

    Aircraft Ban, travel ban, service prohibition, dealing with securities, asset freeze and ship ban

    Malicious Russian Cyber Actor, undermining of Ukraine’s sovereignty and territorial integrity

    Programme NZ-RSA2022mfat.govt.nz

Connections3

Other links3

Other names21

Also known as15

“Benny”Vitaly Nikolayevich KOVALEV“Ben”“Stern”“Alex Konor”“Bentley”Виталий Николаевич КовалевVitaliy Kovalev“Bergen"Vitaly KOVALEVВиталий Николаевич КОВАЛЕВVitaliy KOVALEVVitaliy Nikolayevich KOVALEVKOVALEV, Vitaly NikolayevichVITALII NIKOLAEVICH KOVALEV

Weak aliases6

Spellings the source flags as too generic to establish a match on their own.

BergenAlex KonorBentleySternBenBenny

Addresses7

  • Serebristy Bulvar 34 (SerebristyyBul'var), krp 1, flt 528, 197341, Saint-Pétersbourg

  • 197341

  • Serebristy Bulvar 34 (Serebristyy Bul’var)

  • flt 528

  • Serebristy Bulvar 34 (Serebristyy Bul'var), krp 1, flt 528, 197341, Saint-Pétersbourg, Fédération de Russie

  • krp 1

  • St Petersburg, Russian Federation

This page shows the public record as its publishers state it. A name here is not by itself a finding: whether a record refers to a particular person or company is what screening decides. Read the full notice.