Armenia Detains Russian Tourist on U.S. Warrant for REvil Hacker, Lawyers Say Wrong Man
A Russian tourist, Aleksandr Yuryevich Ermakov, is being held in Armenia on a U.S. extradition warrant, despite his lawyers arguing he is the wrong man. The U.S. seeks Aleksandr Gennadievich Ermakov, a Russian national previously sanctioned for his involvement with the REvil ransomware gang and a Medibank Private hack. The case highlights a complex international legal battle and potential errors in automated identification systems.
A Russian tourist, Aleksandr Yuryevich Ermakov, is currently being detained in Armenia on a U.S. extradition warrant. His lawyers maintain that he is not the Aleksandr Gennadievich Ermakov targeted by the U.S. Justice Department, who is wanted for his alleged involvement with the REvil ransomware gang and a 2022 hack of Medibank Private. The U.S. seeks this individual, who was sanctioned by Australia, the US, and the UK in January 2024 for stealing 9.7 million records and dumping them on the dark web.
Ermakov, the man currently held in Armenia, is a former prison-service lawyer from Omsk, Russia, and does not speak English. The U.S. warrant is based on a complex chain of events, including an Interpol notice and a U.S. court case. The Justice Department alleges that Ermakov participated in Sodinokibi/REvil attacks from approximately April 2019 to July 12, 2021, targeting over 1,000 victims across various sectors, including private companies, law enforcement, government offices, schools, and hospitals in Texas.
The case is complicated by potential errors in automated identification systems. The U.S. warrant appears to have been generated from a U.S. court case, relying on a given name and surname without additional identifying information. The lawyers argue that a simple check of the name and surname led to the mistaken arrest, and that standard identification methods, such as fingerprints or passport data, were not used.
Russian authorities have also been involved, with a Moscow court giving Ermakov two years of restriction of freedom for co-writing SugarLocker ransomware. The case highlights a complex international legal battle, with multiple news outlets involved in reporting on the case, all linked through National Media Group. The Armenian court now needs to decide whether to extradite the man in the cell to Dallas, and his family expects this process to proceed. The entire situation underscores the challenges of international law enforcement and the potential for errors in automated systems.