Armenia detains Aleksandr Ermakov on US REvil warrant

Confirmed: Aleksandr Ermakov, a Russian tourist, has been held at a detention centre in Yerevan since 2026-06-28 on a US extradition request tied to a REvil / Sodinokibi ransomware suspect of the same name. The Hacker News filed the reporting today, aggregating Russian outlet interviews with the detainee’s family, his lawyer, and Armenian court paperwork. Confidence on the detention itself and the underlying US warrant: confirmed. Confidence that the man in Armenian custody is the same Aleksandr Ermakov named on the warrant: unconfirmed — treat accordingly.

Timeline

• 2026-06-26 — US warrant issued out of the Northern District of Texas naming an Aleksandr Ermakov in connection with the REvil / Sodinokibi operation. Alleged activity window per the charging documents reviewed by RIA Novosti: April 2019 through 2021-07-12, across more than 1,000 victims.
• 2026-06-28 — Armenian border officers pull the detainee out of the departure hall at Yerevan’s Zvartnots airport, per his wife Maria Yurova, speaking to Russian outlet REN TV. Yurova said the officers held up a phone displaying a photo taken from her husband’s VKontakte page before walking him into a side room.
• On or around 2026-06-28 — Armenian court applies a 30-day Interpol notice while Moscow files for consular access. Details of the Interpol notice itself are not public.
• 2026-07-17 (today) — The Hacker News aggregates the case for an English-language audience, citing REN TV, TASS, Izvestia, RIA Novosti, and Channel Five for the underlying reporting. No US Justice Department confirmation on the specific identity match has been published.

What is confirmed

• The US wants an Aleksandr Ermakov. The name is on the warrant. Sanctions authorities in Australia, the US, and the UK already designated an “Aleksandr Ermakov” in January 2024 over the October 2022 Medibank Private breach — 9.7 million records. That designation is public record, not disputed. Public forum-handle attributions for the sanctioned figure include blade_runner, GistaveDore / GustaveDore, and JimJones, per Intel 471’s contemporaneous analysis.
• Someone named Aleksandr Ermakov is in Armenian custody. The detention, the location, the date, and the 30-day Interpol hold are all attested by Russian-language outlets on the ground and are not contested by any party in the story.
• The Russian domestic legal record for the sanctioned Ermakov is separate and specific. Per TASS and case files reviewed by Izvestia, the sanctioned Aleksandr Gennadievich Ermakov — born 1990-05-16, Moscow — is currently serving a two-year Russian restriction of freedom under Article 273(2) for co-writing the SugarLocker ransomware, sentenced in October 2024 under summary procedure, and is barred from leaving Russia as a condition of that sentence.

What is not confirmed

• That the detained man is the sanctioned man. The detainee’s lawyer, Dylan Rajavi, told Izvestia the extradition paperwork he has seen “carried a given name and a surname, no more” — no patronymic, no date of birth, no fingerprint set, no full passport data. Russian identity documents include patronymics precisely to disambiguate common name pairs. The Australian and UK sanctions entries carry the patronymic “Gennadievich”; the US Treasury OFAC entry, per the same Izvestia reporting, does not. The absence of a patronymic on the paperwork is the specific basis for the defence claim of misidentification. Unconfirmed — but note that the paperwork gap is a documented fact, not a defence flourish.
• The detainee’s background as described by his family. Yurova told REN TV that her husband is a former prison-service lawyer from Omsk who does not speak English. That description has not been independently verified in the English-language reporting, and it obviously cuts against the identity claim. Treat as the family’s account, not established fact.
• How Armenian courts will handle the 30-day window. No public ruling on extradition yet. Moscow has requested consular access; whether that access has been granted is not stated in today’s reporting.
• A US Justice Department public position. The reporting chain runs through Russian outlets. No DOJ statement, no CISA statement, no publicly released affidavit with disambiguating identifiers has surfaced in the English-language press as of this filing.

Why this matters

Two years of ransomware-prosecution pipeline stories have followed the same beat: a named operator or affiliate gets designated, travels to a jurisdiction that will hand them over, and the extradition works — as it did with the Ryuk affiliate who pleaded guilty in Portland last week, and as the West is betting the first joint EU/UK cyber sanctions round from July 13 will eventually enable. That pipeline only functions if the person on the plane is the person on the paperwork. A misidentification — if that is what this is — burns the tool. If it is not a misidentification, an Ermakov whose Russian court record has him restricted from leaving Russia was leaving Russia on a tourist trip, which is its own story.

Neither branch has landed yet. The 30-day Interpol window runs out around 2026-07-28. Watch that date.

Sources

• The Hacker News — Armenia Detains Russian Tourist on U.S. Warrant for REvil Hacker, Lawyers Say Wrong Man (2026-07-17)
• US Treasury OFAC — Cyber-related Designations, 2024-01-23 (original Medibank designation, referenced above)
• Australian Government — Autonomous Sanctions announcement, 2024-01-23