German police call Vitaly Kovalev a founder of Trickbot, the hacking group whose ransomware hit U.S. hospitals. New People had him on its Duma candidate list before dropping him in July. | #ransomware | #cybercrime

The New People party placed Vitaly Kovalev, a 38-year-old wanted by Interpol for organizing a criminal enterprise, on its federal candidate list for the State Duma elections.

Kovalev was initially included in regional group No. 18, covering Kalmykia and the Volgograd and Astrakhan regions. He was removed from the list, however, before the Central Election Commission certified the candidate lists in July.

Kovalev has faced charges in the United States since 2012 for conspiracy to commit bank fraud and unauthorized access to bank accounts, including in connection with the activities of the hacking group. According to the U.S. Secret Service website, Kovalev and his accomplices gained access to accounts at at least three American financial institutions and illegally transferred nearly $1 million from them. In 2020, at the height of the pandemic, Trickbot attacked the U.S. health care system, infecting American hospitals and medical facilities with ransomware on a mass scale.

Germany’s Federal Criminal Police Office suspects that Kovalev, as the founder of the hacking group behind the Trickbot malware, “made a substantial contribution to carrying out global cyberattacks.” Interpol’s wanted persons database lists Kovalev as the organizer of a criminal enterprise.

At least as of 2025, Kovalev was an adviser to Vladislav Davankov, a State Duma deputy speaker from New People, who mentioned him on his Telegram channel. In August 2025, Davankov wrote that he had visited the longevity laboratory at Volgograd State Medical University with “entrepreneur and medical technology investor Vitaly Kovalev, who has been my adviser for more than a year now.”