US and UK Target Trickbot Operators With Arrests, Charges, and Sanctions

U.S. authorities charged Latvian national Alla Witte, also known as "Max", for allegedly serving as a malware developer for the Trickbot cybercrime group, accusing her of writing source code used to control the malware, deploy ransomware, track authorized users, manage victim payments, and store stolen credentials. Prosecutors said Trickbot began operating by late 2015, infected millions of computers worldwide, stole banking and personal information, and was used against businesses, hospitals, schools, utilities, and government entities. Witte was arrested in Miami and arraigned in federal court in Ohio on 19 counts from a broader 47-count indictment tied to the gang.

The case formed part of a wider campaign against the Russia-linked operation and its support network. The United States and United Kingdom later imposed joint sanctions on seven alleged Trickbot members, describing the malware as a banking trojan that evolved into a modular platform for financial theft and ransomware, including attacks on healthcare providers. U.S. officials also linked Trickbot to money-laundering services provided by QQAAZZ, a criminal organization accused of washing tens of millions of dollars for actors tied to Trickbot, Dridex, and GozNym, underscoring how law enforcement pursued both the malware developers and the financial infrastructure behind the group.