Armenia Detains Russian Tourist on U.S. Warrant for REvil Hacker, Lawyers Say Wrong Man

Armenia has held a Russian tourist named Aleksandr Ermakov in a detention center since June 28, on a U.S. extradition request for a REvil ransomware suspect named Aleksandr Ermakov.

His wife, Maria Yurova, told REN TV that border officers pulled him out of the departure hall at Yerevan's Zvartnots airport, held up a phone with a photo of him off his VKontakte page, and walked him into a side room. His lawyers say Washington has the wrong man.

The Ermakov the U.S. wants is Aleksandr Gennadievich Ermakov, sanctioned by Australia, the US, and the UK in January 2024 for stealing 9.7 million records from Medibank Private, one of Australia's largest private health insurers, and dumping some on the dark web.

He is also serving a two-year Russian sentence that bars him from leaving the country, according to TASS and to case files two Russian outlets say they have read. The man in the Armenian cell, his lawyers say, is Aleksandr Yuryevich Ermakov, from Omsk, a former prison-service lawyer who does not speak English.

Ermakov is accused of taking part in Sodinokibi/REvil attacks from roughly April 2019 to July 12, 2021, with more than 1,000 victims among private companies, law enforcement, government offices, schools, and hospitals, some in the Northern District of Texas.

That comes from the US charging document, which RIA Novosti says it holds. The Interpol notice built on it, which Izvestia says it has, goes further: one of the platform's administrators, with a take of over $13.7 million. Channel Five dates the warrant to that district's federal court, June 26, two days before the arrest.

Medibank was hacked in October 2022, fifteen months after that window closes, and the US has never announced a charge against Ermakov over it. Treasury's designation put him at REvil's edge, an actor "believed to be linked" to the gang. The notice puts him at its center. That court has seen REvil before: DOJ charged Yevgeniy Polyanin there in 2021 over Sodinokibi/REvil attacks on Texas businesses and government entities on or about August 16, 2019.

Russian passports carry a patronymic, and it is the field that tells one Aleksandr Ermakov from the next. Australia's consolidated list has it: Aleksandr Gennadievich Ermakov, born 16 May 1990. The UK's entry has it. OFAC's does not.

The SDN record runs: ERMAKOV, Aleksandr, Moscow, DOB 16 May 1990, male, one Yandex address, four handles (blade_runner, GistaveDore, GustaveDore, JimJones). Given name, surname, nothing in between. What the Interpol notice itself carries is not public.

Dylan Rajavi, one of the detained man's lawyers, told Izvestia the defense's working theory is that the U.S. paperwork carried a given name and a surname, no more, and an automated check did the rest. He also said there are standard ways to settle who someone is, fingerprints or full passport data, and that neither has been produced.

"There is only an arrest warrant," he said. That is the defense's account, not a finding.

Armenian authorities have said nothing, the Justice Department has announced no charges, and none of the Russian outlets holding the documents says how it got them. Nor are there as many outlets as they look: Izvestia, REN TV, and Channel Five all sit under National Media Group, and Izvestia's newsroom has supplied the news for the other two since 2017. The man is being held on a 30-day Interpol detention order while Moscow asks Yerevan for consular access.

Where the Name Came From

Australia's signals directorate and federal police spent 18 months on Operation Aquila before naming him. And the chain from the sanctioned Ermakov to SugarLocker does not run through Russian state media.

Once Australia published the nicknames, Intel 471 went back through years of collected forum data. SHTAZI and shtaziIT were among Ermakov's handles, it reported, and his alias JimJones had spent 2019 and 2020 on the Exploit forum hawking malware development and a dev shop called Shtazi-IT.

A month later, Russian police said they had rolled up the SugarLocker ransomware crew operating behind Shtazi-IT, with @GustaveDore sitting in the contact field of its developer job ads. A US vendor and Russia's interior ministry reached the same shopfront from opposite ends.

In October 2024, a Moscow court gave Ermakov two years of restriction of freedom under Article 273(2), Russia's malware statute, for co-writing SugarLocker and selling it to a buyer with a Tor control panel attached.

Case material seen by Izvestia says he pleaded guilty, and the case ran through Russia's summary procedure. "Ermakov was sentenced to 2 years of restriction of freedom," a law enforcement source told state agency TASS on Thursday. The term has not run out.

Armenia's court still has to decide whether to put the other Ermakov on a plane to Dallas, and his brother told RIA on Friday the family expects it to go through. Two and a half years of sanctions, an 18-month intelligence operation, and a new U.S. warrant have, between them, put exactly one Aleksandr Ermakov in a cell, and his lawyers say it is the wrong one.

The Ermakov warrant name is at home, reporting once a month to the prison service that the man in the cell spent his career working for.