Border officers pulled him out of the departure hall at Yerevan's Zvartnots airport, held up a phone with a photo from his VKontakte page and walked him into a side room, Maria Yurova, his wife, told REN TV — and since June 28 a man named Aleksandr Ermakov has been held in an Armenian detention center on an extradition request the United States filed for a REvil ransomware suspect, lawyers say the wrong man is in custody.
Who is in the cell in Yerevan?
Lawyers for the detained man say the person held in Armenia is Aleksandr Yuryevich Ermakov, from Omsk — a former prison‑service lawyer who does not speak English. The family has said the brother expects Yerevan's court to send him to Dallas. The detention is on a 30‑day Interpol hold while Moscow requests consular access, according to the Russian outlets reporting the case.
Defense counsel Dylan Rajavi told Izvestia their working theory is that U.S. paperwork contained only a given name and a surname, which an automated check then matched. He said standard identity‑confirming material — fingerprints or full passport data — have not been produced; "There is only an arrest warrant," Rajavi told the outlet. That is the defense account reported by the Russian media, not a judicial finding.
Who does the United States and partners say they want?
The U.S. and allied actions target a different man: Aleksandr Gennadievich Ermakov. According to the reporting, Australia, the United States and the United Kingdom sanctioned Aleksandr Gennadievich Ermakov in January 2024 in connection with the alleged theft of 9.7 million Medibank Private records and subsequent dark‑web dumping. The SDN (Specially Designated Nationals) record cited in the reporting lists: ERMAKOV, Aleksandr, Moscow, DOB 16 May 1990, male, one Yandex address and four handles (blade_runner, GistaveDore, GustaveDore, JimJones); notably, OFAC’s SDN entry shown in the reporting does not include a patronymic.
Russian reporting says the U.S. charging document alleges participation in Sodinokibi/REvil attacks from roughly April 2019 to July 12, 2021, with more than 1,000 victims across private companies, law enforcement, government offices, schools and hospitals, and includes cases in the Northern District of Texas. RIA Novosti and Izvestia say they have seen versions of the U.S. charging material and the Interpol notice; Channel Five dates the Dallas warrant to June 26, two days before the arrest in Yerevan.
Sanctions, a Russian sentence, and alleged ties to SugarLocker
Russian outlets reporting on the sanctioned Ermakov say he received a two‑year restriction‑of‑freedom sentence in October 2024 under Article 273(2) — Russia’s malware statute — for co‑writing a ransomware called SugarLocker and selling it, including a Tor control panel attachment. TASS reported that the term has not yet run its course, and that the sentenced man reports once a month to the prison service.
The link to SugarLocker in the reporting traces back through Australian investigative work called Operation Aquila and through forum traces reviewed by vendor Intel 471: aliases including SHTAZI, shtaziIT and JimJones were associated with a dev shop called Shtazi‑IT and with job postings listing @GustaveDore as a contact. Russian police later said they rolled up the SugarLocker crew, and court material cited by Izvestia says the sentenced Ermakov pleaded guilty via summary procedure.
Procedural posture in Armenia and the reporting trail
Armenian authorities, the Justice Department and the Interpol notice’s public text have not been disclosed in the reporting. The Russian outlets that published the documents — Izvestia, REN TV and Channel Five — all belong to National Media Group, and Izvestia’s newsroom has supplied material for the other two since 2017, the reports note. None of the outlets says how it obtained the U.S. documents it cites.
Armenia’s court must now decide whether to extradite the detained man to Dallas. The reporting records a factual tension: between an international sanctions and investigative trail pointing at an Aleksandr Gennadievich Ermakov with a Moscow date of birth and forum handles, and the man physically detained in Yerevan who, his lawyers say, bears a different patronymic and a Russian sentence that bars travel.
What this means for Armenia, the detained man's lawyers, and U.S. prosecutors
- Armenia: Yerevan's courts will be asked to reconcile an Interpol detention order and a foreign warrant with competing identity claims and a consular request from Moscow; the court’s decision will determine whether the detainee is sent to the U.S. or returned to Russia for consular protection.
- The detained man's lawyers: They have a narrow factual strategy — contest misidentification by highlighting the missing patronymic, absence of passport or fingerprint evidence in the public reporting, and the existing Russian sentence and reporting that the sentenced Ermakov still reports to authorities.
- U.S. prosecutors (per the reporting): The warrant in the Northern District of Texas anchors alleged Sodinokibi/REvil activity and a large victim count; how U.S. charging documents and Interpol notices present identity markers (patronymic, passport details) will shape extradition arguments in Yerevan.
The immediate next step recorded in the reporting is procedural: Armenia’s court must act on the Interpol order and the extradition request while Moscow seeks consular access and the defense presses identity questions. The sequence of filings and whether full identity evidence is produced will decide if that cell in Yerevan holds the man Washington sought or someone else entirely.
