Armenian authorities have detained a Russian citizen named Aleksandr Ermakov following a U.S. extradition request linked to alleged REvil (Sodinokibi) ransomware activity. However, his lawyers claim authorities have arrested the wrong person.

The man has been held in an Armenian detention center since June 28, 2026, after being detained at Zvartnots International Airport in Yerevan while preparing to leave the country.

According to his wife, Maria Yurova, border officers identified him using a photograph from his VKontakte profile before escorting him to a secondary screening area and subsequently detaining him.

Lawyers Claim U.S. Is Seeking a Different Aleksandr Ermakov

The defense argues that the detained individual is:

Aleksandr Yuryevich Ermakov
- From Omsk, Russia
- Former prison-service lawyer
- Does not speak English
- No known links to REvil ransomware operations

The individual sought by U.S. authorities is reportedly:

Aleksandr Gennadievich Ermakov
- Born May 16, 1990
- Previously sanctioned by:
- United States
- United Kingdom
- Australia
- Linked to the 2022 Medibank breach
- Allegedly associated with the REvil ransomware operation

According to defense attorney Dylan Rajavi, authorities have yet to provide fingerprint evidence, full passport information, or other biometric proof confirming that the detained individual matches the suspect named in the extradition request.

"There is only an arrest warrant," Rajavi reportedly stated.

Alleged REvil Involvement

U.S. court documents reportedly accuse the wanted Ermakov of participating in REvil/Sodinokibi ransomware operations between:

  • April 2019
  • July 12, 2021

The campaign allegedly impacted:

  • Private companies
  • Government agencies
  • Law enforcement organizations
  • Schools
  • Hospitals

with more than 1,000 victims worldwide, including organizations located in the Northern District of Texas.

Some reports further allege that the suspect served as a REvil administrator and received more than $13.7 million in proceeds from ransomware operations.

Medibank Connection

The case gained additional attention due to the 2022 cyberattack against Australian health insurer Medibank Private, where approximately 9.7 million customer records were stolen and partially leaked online.

In January 2024, Australia, the United States, and the United Kingdom imposed sanctions against Aleksandr Gennadievich Ermakov for his alleged involvement in the breach.

However, legal representatives for the detained man note that:

  • The Medibank attack occurred in October 2022
  • The REvil activity referenced in U.S. documents ended in July 2021
  • U.S. authorities have not publicly charged Ermakov in connection with Medibank

Identity Confusion Concerns

A key issue centers on Russian naming conventions.

Russian passports include a patronymic — a middle name derived from a person's father's name — which helps distinguish individuals with identical first and last names.

The defense argues that:

  • Sanctions records identify Aleksandr Gennadievich Ermakov
  • The detainee is Aleksandr Yuryevich Ermakov
  • The extradition process may have relied on incomplete identity information

Lawyers speculate that an automated watchlist or database match based solely on first and last name may have contributed to the arrest.

Previous Russian Conviction

The sanctioned Ermakov was previously convicted in Russia under Article 273(2), a law covering the development and distribution of malicious software.

Russian media reports indicate he:

  • Pleaded guilty
  • Received a two-year restriction-of-freedom sentence
  • Was prohibited from leaving Russia during that period

If accurate, this would raise questions about how he could have traveled internationally and appeared in Armenia.

Armenia Yet to Decide Extradition

Armenian authorities have not publicly commented on the case.

The detained man is currently being held under a 30-day Interpol detention order while legal proceedings continue.

Russia has reportedly requested consular access, and Armenian courts must now determine whether extradition proceedings will move forward.

At the center of the dispute is a simple but critical question:

Did Armenia arrest the REvil suspect sought by U.S. authorities, or an entirely different Aleksandr Ermakov with the same name?

The answer could determine whether a ransomware suspect is extradited to the United States—or whether an innocent traveler is mistakenly caught in an international cybercrime investigation.