Armenia Locks Up Russian Tourist Named Aleksandr Ermakov. Problem: There Are Two of Them.

Since 28 June, a Russian man named Aleksandr Ermakov has been sitting in an Armenian detention centre after being pulled from the departure hall at Yerevan's Zvartnots airport. Border officers, according to his wife Maria Yurova, walked up with a phone showing a photo pulled from his VKontakte profile, confirmed the face matched, and escorted him into a side room. The U.S. wants an Aleksandr Ermakov for REvil ransomware crimes. His lawyers say they've got the wrong one.

The Ermakov Washington actually wants is Aleksandr Gennadievich Ermakov, sanctioned jointly by Australia, the U.S., and the UK in January 2024 for the October 2022 hack of Medibank Private. That breach exposed 9.7 million records from one of Australia's biggest health insurers, with some of the stolen data later dumped publicly on the dark web. He was also convicted by a Moscow court in October 2024 under Russia's malware statute for co-authoring the SugarLocker ransomware and flogging it with a Tor-based control panel attached. He received two years of restricted freedom, a sentence that legally bars him from leaving the country. He is, by all accounts, still in Russia.

The man currently in Armenian custody is Aleksandr Yuryevich Ermakov, from Omsk. His lawyers describe him as a former prison-service lawyer with no English. Different patronymic. Different biography. Same name on the warrant.

The U.S. charging document, which RIA Novosti claims to have obtained, accuses its Ermakov of participating in Sodinokibi/REvil ransomware attacks between approximately April 2019 and July 2021, hitting over a thousand victims across private companies, schools, hospitals, government offices, and law enforcement, some in the Northern District of Texas. The Interpol notice built on that charge, seen by Izvestia, goes further, placing him as one of the platform's administrators who pocketed more than $13.7 million. Channel Five reports the arrest warrant was issued by that federal court on 26 June, two days before the arrest at the airport.

Here is where the paperwork becomes the story. Russian passports include a patronymic, the middle name derived from the father's given name, which is precisely how you distinguish one Aleksandr Ermakov from another. Australia's sanctions list has it: Aleksandr Gennadievich Ermakov, born 16 May 1990. So does the UK's. The U.S. Treasury's OFAC entry does not. The SDN record lists ERMAKOV, Aleksandr, Moscow, date of birth 16 May 1990, along with a Yandex address and four known handles including blade_runner, GustaveDore, and JimJones. No patronymic.

Defence lawyer Dylan Rajavi told Izvestia the most plausible explanation is that the U.S. paperwork contained only a given name and surname, an automated system flagged the match, and nobody checked further. He added that standard identity verification methods exist, fingerprints, full passport data, and that neither has been produced. "There is only an arrest warrant," he said. That is the defence's position, not a judicial finding.

The trail to the actual Ermakov was genuinely thorough. Australia's Signals Directorate and Federal Police spent 18 months on Operation Aquila before publishing his name and handles. After that, threat intelligence firm Intel 471 matched the published aliases back through years of forum data, identifying SHTAZI and shtaziIT as his handles, with JimJones active on the Exploit forum in 2019 and 2020 advertising malware development services through a shop called Shtazi-IT. Russian police then independently dismantled the SugarLocker crew operating behind that same shopfront, with the Telegram handle @GustaveDore appearing in its developer job listings. Two separate investigative threads, one Western, one Russian, converged on the same person.

He pleaded guilty. The case ran through Russia's summary procedure. A Moscow court sentenced him last October. His restriction order has not expired.

Meanwhile, Armenian authorities have said nothing publicly. The Justice Department has made no announcement. The detained man is being held on a 30-day Interpol detention order while Russia seeks consular access. His brother told RIA Novosti on Friday that the family expects extradition to proceed.

One more wrinkle: the outlets breaking this story, Izvestia, REN TV, and Channel Five, all sit under the same umbrella, National Media Group, and Izvestia has been feeding news to the other two since 2017. They look like independent corroboration. They are not.

Nearly three years of international sanctions, an 18-month intelligence operation, and a fresh federal warrant have collectively succeeded in detaining one Aleksandr Ermakov. His lawyers say he is the wrong one. The man the warrant was written for is at home, checking in monthly with the prison service the man in the Armenian cell used to work for.