Loading story…
U.S. authorities extradited Armenian national Hambardzum Minasyan to face charges for allegedly helping develop and operate the RedLine infostealer malware, a tool widely used to steal login credentials and other sensitive data from victims’ computers. Prosecutors accused Minasyan of maintaining key RedLine infrastructure, including virtual private servers, internet domains, malware distribution repositories, and a cryptocurrency account used to collect payments from affiliates who deployed the malware.
The indictment charges Minasyan with conspiracy to commit access device fraud, conspiracy to violate the Computer Fraud and Abuse Act, and conspiracy to commit money laundering. The case follows the multinational Operation Magnus disruption of the RedLine and Meta infostealers in 2024, carried out with authorities in the United States, Belgium, the Netherlands, and Eurojust. U.S. officials had previously charged alleged co-conspirator Maxim Rudometov, identified as a RedLine developer and administrator, and also launched a public website for victims seeking information and assistance.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
After his extradition, prosecutors charged Minasyan with conspiracy to commit access device fraud, conspiracy to violate the Computer Fraud and Abuse Act, and conspiracy to commit money laundering. The Justice Department alleges he helped maintain RedLine servers, domains, and malware distribution repositories.
U.S. authorities announced that Hambardzum Minasyan was extradited from Armenia to the United States over his alleged role in operating RedLine. Prosecutors say he helped host infrastructure, distribute the malware to affiliates, and receive affiliate payments via cryptocurrency.
During the 2024 international operation, U.S. authorities unsealed charges against Russian national Maxim Rudometov for his alleged role in developing and administering the RedLine infostealer.
In October 2024, U.S., Belgian, Dutch, and Eurojust authorities carried out Operation Magnus to disrupt the RedLine and Meta infostealer infrastructure. The operation also included the launch of a public victim-resource website.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
6 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcetherecord.media
Open sourcecyberscoop.com
Open sourcejustice.gov
Open sourcespycloud.com
Open sourceinfosec.pub
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Dutch police, the FBI, and international partners disrupted the **RedLine** and **META** infostealer operations in a coordinated action dubbed **Operation Magnus**, seizing or taking control of infrastructure used to run the malware-as-a-service platforms. Authorities said they hacked or dismantled servers tied to both strains, replacing criminal infrastructure with law-enforcement notices and aiming to cut off panels and backend systems used by cybercriminal customers to steal credentials, browser data, cookies, and cryptocurrency wallet information from victims worldwide. The U.S. Department of Justice said the United States joined the international action and separately unsealed charges against a Russian national accused of helping develop and administer **RedLine**. Reporting on the operation said investigators targeted what officials described as the core infrastructure behind two of the most widely used infostealers in the cybercrime ecosystem, combining technical disruption with criminal charges to weaken both the malware services and the people allegedly operating them.
Jul 12, 2026
Armenian authorities detained Russian tourist **Aleksandr Yuryevich Ermakov** in Yerevan on June 28 under a U.S. extradition request tied to alleged **REvil** ransomware activity, but his lawyers say he is not the wanted cybercriminal. The dispute centers on whether U.S. prosecutors and an Interpol notice were actually seeking **Aleksandr Gennadievich Ermakov**, a different Russian man sanctioned by the United States, United Kingdom, and Australia for alleged links to REvil and the 2022 **Medibank** breach. Reporting indicates the extradition paperwork may have omitted key identifying details, including a patronymic, creating the risk of a mistaken match. U.S. charging materials cited in the case accuse an Aleksandr Ermakov of involvement in **Sodinokibi/REvil** attacks from April 2019 to July 2021, with the Interpol notice reportedly describing a platform administrator who earned more than **$13.7 million** and whose operations hit more than **1,000** organizations, including businesses, government offices, schools, and hospitals. Defense lawyers also suggested automated matching may have contributed to the detention, while Armenian authorities and the U.S. Justice Department had not publicly clarified the identity issue at the time of reporting.
Jul 18, 2026
Russian national **Searzhudin Tamirlanovich Aktulaev** was extradited from Cyprus to the United States to face federal charges over an alleged 2016–2017 phishing operation that compromised more than 80,000 computers. Prosecutors allege Aktulaev and co-conspirators created roughly 255 fraudulent accounts on a freelance-employment platform and sent targets malicious Excel attachments designed to persuade them to enable macros. The macro-enabled files allegedly downloaded the **TVRAT** and **DarkVNC** remote-access trojans, allowing the operators to steal victim information and exfiltrate it through U.S.-hosted command-and-control infrastructure. The campaign affected thousands of victims, approximately half in the United States; Aktulaev faces charges including conspiracy, computer-damage offenses, and aggravated identity theft, with potential penalties of up to 20 years in prison.
Sep 4, 2026