**The Wrong Aleksandr Ermakov? Armenia Holds Ransomware Suspect Amid US Extradition Request**
In a case that reads like a thriller of mistaken identity, Armenia is currently holding a Russian tourist named **Aleksandr Ermakov** in a detention center. The man was pulled from Yerevan’s Zvartnots airport on June 28th due to a U.S. extradition request. However, his lawyers and family argue a grave error has been made: the authorities have the wrong man. The U.S. is seeking to extradite **Aleksandr Gennadievich Ermakov**, a notorious REvil/Sodinokibi hacker, while the man in the Armenian cell is identified as **Aleksandr Yuryevich Ermakov**, a former prison-service lawyer from Omsk who does not speak English.
### A Case of Mistaken Identity
The confusion stems from the fact that Russian passports use a patronymic naming system, creating multiple individuals with the same first and last name. The U.S. wants **Aleksandr Gennadievich Ermakov**, who is sanctioned by the U.S., UK, and Australia for his role in the massive Medibank hack of 2022. He is accused of stealing 9.7 million patient records and dumping them on the dark web.
Conversely, the man detained in Armenia is **Aleksandr Yuryevich Ermakov**. His lawyers claim he has never left Russia and has no connection to cybercrime. They assert that an automated check, likely based on the shared name and the extradition paperwork lacking a middle name (patronymic), triggered the arrest.
### The REvil Connection
Ermakov (the one the U.S. seeks) is alleged to be a central figure in the REvil ransomware gang. According to U.S. charging documents and an Interpol notice, he participated in Sodinokibi/REvil attacks from approximately April 2019 to July 2021. These attacks targeted over 1,000 victims, including private companies, law enforcement, government offices, schools, and hospitals, causing significant disruption. He is also reported to be a platform administrator who amassed over $13.7 million from the criminal enterprise.
A separate Russian case file details a different Aleksandr Ermakov (Aleksandr Gennadievich) pleading guilty to co-writing the SugarLocker ransomware and receiving a two-year restricted freedom sentence in October 2024. This sentence, according to TASS, has not yet been completed.
### The Current Standoff
Armenian authorities have remained silent on the matter. The U.S. Department of Justice has not announced any charges in connection with the Medibank hack, and Russian state media outlets holding the documents are part of the National Media Group conglomerate. The detained Ermakov is currently being held on a 30-day Interpol detention order while Moscow requests consular access to investigate the identity claim.
—
### FAQ Section
**Q: Why does the U.S. want Aleksandr Ermakov extradited?**
A: The U.S. seeks his extradition for his alleged role as a central administrator and hacker for the REvil (Sodinokibi) ransomware gang. He is accused of participating in attacks that stole and leaked millions of records from entities like Medibank Private, causing massive financial and data damage.
**Q: What is the difference between the two Aleksandr Ermakovs?**
A: The primary difference is the patronymic (middle name) derived from their father’s name. The wanted suspect is **Aleksandr Gennadievich Ermakov**. The man in Armenia is **Aleksandr Yuryevich Ermakov**. This distinction is crucial in Russian naming conventions and is the core of the identity confusion.
**Q: What evidence does the defense have?**
A: The defense argues that U.S. extradition paperwork contained only a given name and surname (“Aleksandr Ermakov”), which an automated system could have matched to the wrong person. They contend that standard identification methods, such as fingerprinting or verifying full passport data (including the patronymic), were not properly utilized.
**Q: Is the man in custody guilty of the Medibank hack?**
A. No. The man currently in detention in Armenia has not been charged with the Medibank hack. He has been sentenced in Russia for co-developing the SugarLocker ransomware, a separate criminal enterprise from the Medibank incident. The U.S. has not filed charges against him for the Medibank breach.
—
### Conclusion
The case of the detained Russian tourist highlights the complexities of international cybercrime, where digital trails, naming conventions, and jurisdictional overlaps can create a perfect storm of confusion. While the world watches, Armenia holds a man whose very identity is the subject of a transcontinental legal battle. Whether a tragic case of mistaken identity or a deliberate act of evasion, the resolution will depend on meticulous forensic verification and the fragile cooperation between nations. The story serves as a stark reminder that in the digital age, proving who you are can be just as complicated as hiding who you really are.
