Armenia Grabs Russian Tourist at Yerevan Airport on U.S. REvil Warrant

Key points

• Armenian border officers detained Russian tourist Aleksandr Ermakov at Zvartnots airport in Yerevan on June 28, 2024, acting on a United States extradition request.
• The warrant names an Aleksandr Ermakov linked to REvil, a Russian-speaking ransomware crew that extorted hundreds of companies worldwide before being disrupted in 2022.
• Ermakov's wife, Maria Yurova, told Russian broadcaster REN TV that officers identified her husband using a photo pulled from his VKontakte social media page.
• His lawyers say Armenian authorities have detained the wrong man and that the name overlap is a coincidence.
• Ermakov remains in an Armenian detention facility while courts weigh the U.S. Handover request.

A Russian tourist named Aleksandr Ermakov has been sitting in an Armenian detention center since June 28, and the reason is a name.

The United States wants an Aleksandr Ermakov. That Ermakov, according to prior U.S. And allied sanctions filings, is tied to REvil, the Russian-speaking ransomware gang that locked up files at hospitals and law firms across the West and demanded payment to restore them. Ransomware is malicious software that scrambles a victim's data until a ransom is paid.

The man in the Armenian cell says he is not that guy.

His wife, Maria Yurova, told Russian broadcaster REN TV, in reporting picked up by The Hacker News, that the couple were flying out of Zvartnots airport in Yerevan on June 28 when border officers pulled her husband from the departure hall. She said the officers held up a phone showing a photograph lifted from his VKontakte page, the Russian equivalent of Facebook, and walked him into a side room. He hasn't come out since.

Did Armenia arrest the wrong man?

His lawyers say yes. They argue the detained tourist shares only a name with the REvil suspect Washington wants, and that a VKontakte profile picture isn't identification evidence. Armenian authorities haven't publicly disputed that framing, but they haven't released him either. He remains in custody while the extradition paperwork moves through the courts.

That's the crux of the case. Extradition requests travel on names and dates of birth. When two people share a common Russian name, the burden falls on the requesting country to prove the person in the cell is the person on the warrant.

Until that proof lands, an ordinary traveller is being held on suspicion of running one of the most damaging ransomware operations of the past decade.

Why does this name keep coming up?

An Aleksandr Ermakov has been in Western law enforcement crosshairs for years. Australia, the United States and the UK jointly sanctioned a Russian national of that name for his alleged role in the Medibank breach, an attack that exposed the health records of millions of Australians. REvil affiliates were tied to that intrusion.

So the name is real, the charges are real, and Washington's appetite to get hands on someone connected to REvil is very real. What's unclear is whether the man Armenia pulled off a plane is the man on the warrant. We covered a similar airport-arrest-to-extradition sequence on 3 July 2026, when Peter Stokes was moved from Finland to Chicago on hacking charges: that case at least had biometric matching on record before transfer.

What happens next?

An Armenian court will decide whether to approve the U.S. Extradition request. That process involves reviewing identification documents and biometric data, then weighing whatever evidence the requesting country provides linking the detained person to the alleged crimes.

If the identification holds, Ermakov could become one of the highest-profile ransomware suspects ever handed to U.S. Prosecutors. For an innocent man with the same name, the outcome is months behind bars because a border officer matched a face to a social media photo.

He's still in the cell. And REvil, or what's left of it, is still a name that gets people arrested at airports.