“Stern,” Likely Most Prolific Ransomware Operator Ever, Sanctioned by EU as Action Targets Billions in Ransomware Damage

On 13 July 2026 the US, UK, and EU announced one of their largest coordinated cyber enforcement actions to date, sanctioning a broad ecosystem of ransomware operators and enablers. Key designations include Vitaly "Stern" Kovalev (Trickbot/Conti administrator) — whose wallets received over $300M in ransom payments — VPN and cryptor providers implicated in facilitating extortion, LummaC2 infostealer developers, bullet‑proof hosting Media Land LLC, and Russian GRU Unit 29155 affiliates; the report highlights operational scale, cross‑jurisdictional coordination, and impacts to cryptocurrency compliance.