Armenia Grabs Russian Tourist at Yerevan Airport on U.S. REvil Warrant
Aleksandr Ermakov has sat in an Armenian detention center since June 28. His lawyers say the FBI has the wrong man.
Key points
- Armenian border officers detained Russian tourist Aleksandr Ermakov at Zvartnots airport in Yerevan on June 28, 2024, acting on a United States extradition request.
- The warrant names an Aleksandr Ermakov linked to REvil, a Russian-speaking ransomware crew that extorted hundreds of companies worldwide before being disrupted in 2022.
- Ermakov's wife, Maria Yurova, told Russian broadcaster REN TV that officers identified her husband using a photo pulled from his VKontakte social media page.
- His lawyers say Armenian authorities have detained the wrong man and that the name overlap is a coincidence.
- Ermakov remains in an Armenian detention facility while courts weigh the U.S. handover request.
A Russian tourist named Aleksandr Ermakov has been sitting in an Armenian detention center since June 28, and the reason is a name.
The United States wants an Aleksandr Ermakov. That Ermakov, according to prior U.S. and allied sanctions filings, is tied to REvil, the Russian-speaking ransomware gang that locked up files at hospitals, meat processors and law firms across the West and demanded millions to unlock them. (Ransomware is malicious software that scrambles a victim's files until a payment is made.)
The man in the Armenian cell says he is not that guy.
His wife, Maria Yurova, told Russian broadcaster REN TV, in reporting picked up by The Hacker News, that the couple were flying out of Zvartnots airport in Yerevan on June 28 when border officers pulled her husband from the departure hall. She said the officers held up a phone showing a photograph lifted from his VKontakte page, the Russian equivalent of Facebook, and walked him into a side room. He has not come out since.
Did Armenia arrest the wrong man?
His lawyers say yes. They argue the detained tourist shares only a name with the REvil suspect Washington wants, and that a VKontakte profile picture is not identification evidence. Armenian authorities have not publicly disputed that framing, but they have not released him either. He remains in custody while the extradition paperwork moves through the courts.
That is the crux of the case. Extradition requests travel on names, dates of birth and identifying documents. When two people share a common Russian name, the burden falls on the requesting country, in this case the United States, to prove the person in the cell is the person on the warrant.
Until that proof lands, an ordinary traveller is being held on suspicion of running one of the most damaging ransomware operations of the past decade.
Why does this name keep coming up?
An Aleksandr Ermakov has been in Western law enforcement crosshairs for years. In January 2024, Australia, the United Kingdom and the United States jointly sanctioned a Russian national of that name for his alleged role in the 2022 Medibank breach, an attack that exposed the health records of roughly 9.7 million Australians. REvil affiliates were tied to that intrusion.
So the name is real, the charges are real, and the appetite in Washington to actually get hands on someone connected to REvil is very real. What is unclear is whether the man Armenia pulled off a plane is the man on the warrant.
What happens next?
An Armenian court will decide whether to approve the U.S. extradition request. That process typically involves reviewing identification documents, biometric data and any evidence the requesting country provides linking the detained person to the alleged crimes.
If the identification holds, Ermakov could become one of the highest-profile ransomware suspects ever handed to U.S. prosecutors. If it does not, an unlucky traveller with a common name will have spent months behind bars because a border officer matched a face to a social media photo.
For now, he is still in the cell. And REvil, or what is left of it, is still a name that gets people arrested at airports.
