Armenia Detains Russian Tourist on U.S. Extradition Request for REvil Suspect, Lawyers Claim Mistaken Identity
Armenia has detained a Russian tourist, Aleksandr Ermakov, based on a U.S. extradition request for a key figure in the REvil ransomware group, though the detained man's lawyers assert he is the wrong individual.
Armenia is holding a Russian tourist, Aleksandr Ermakov, in a detention center following a U.S. extradition request. The U.S. alleges that the individual they seek is a significant operative within the REvil ransomware group, responsible for numerous high-profile cyberattacks. However, the detained man's wife and legal counsel contend that the individual apprehended is not the intended suspect and has been subjected to mistaken identity.
The U.S. authorities are seeking Aleksandr Gennadievich Ermakov, who was previously sanctioned by Australia, the U.S., and the UK in January 2024. These sanctions were imposed due to his alleged involvement in stealing over 9.7 million records from Medibank Private, a major Australian health insurer, with some of the stolen data subsequently leaked onto the dark web. Compounding the situation, the U.S. alleges that the wanted Ermakov is currently serving a two-year sentence in Russia that prohibits him from leaving the country.
Conversely, the defense team argues that the man detained in Armenia is Aleksandr Yuryevich Ermakov, a former prison-service lawyer from Omsk who reportedly does not speak English. This discrepancy in patronymics, a common identifier in Russian names, is central to the defense's claim. The U.S. charging document, reportedly obtained by Russian outlets, accuses the suspect of participating in Sodinokibi/REvil attacks between April 2019 and July 2021, impacting over 1,000 victims across various sectors, including private companies, law enforcement, government offices, schools, and hospitals.
The Interpol notice, built upon the U.S. charging document, further implicates the suspect as one of the platform's administrators, with an alleged personal profit exceeding $13.7 million. The warrant reportedly originated from a federal court in Texas, dated June 26, just two days prior to the arrest. Notably, the Medibank breach occurred in October 2022, over fifteen months after the alleged window of activity for the suspect, and the U.S. has not publicly announced charges against Ermakov specifically for that incident.
While the U.S. Treasury's designation described the sanctioned Ermakov as "believed to be linked" to the REvil gang, the Interpol notice reportedly places him at the group's core. The Texas court has a history with REvil, having charged Yevgeniy Polyanin in 2021 for similar attacks on Texas businesses and government entities. The specific patronymic, 'Gennadievich' for the sanctioned suspect and 'Yuryevich' for the detained tourist, is a critical distinction that the defense believes was overlooked in the extradition process.
Lawyers for the detained man theorize that the U.S. extradition paperwork may have only included a given name and surname, leading to an automated system flagging the wrong individual. They also point out that standard identification methods like fingerprints or full passport data, which could definitively distinguish between the two individuals, have not been presented. Armenian authorities have remained silent on the matter, and the U.S. Department of Justice has not made any public announcements regarding charges against either individual.
The detained Ermakov is currently being held on a 30-day Interpol detention order while Moscow seeks consular access. The case highlights the complexities of international extradition and the potential for misidentification, especially when dealing with individuals who share the same name but have different identifying details. The final decision on extradition rests with the Armenian court, with the family of the detained man expecting the process to proceed, potentially leading to the wrong Aleksandr Ermakov being sent to the U.S.