Loading story…
Armenian authorities detained Russian tourist Aleksandr Yuryevich Ermakov in Yerevan on June 28 under a U.S. extradition request tied to alleged REvil ransomware activity, but his lawyers say he is not the wanted cybercriminal. The dispute centers on whether U.S. prosecutors and an Interpol notice were actually seeking Aleksandr Gennadievich Ermakov, a different Russian man sanctioned by the United States, United Kingdom, and Australia for alleged links to REvil and the 2022 Medibank breach.
Reporting indicates the extradition paperwork may have omitted key identifying details, including a patronymic, creating the risk of a mistaken match. U.S. charging materials cited in the case accuse an Aleksandr Ermakov of involvement in Sodinokibi/REvil attacks from April 2019 to July 2021, with the Interpol notice reportedly describing a platform administrator who earned more than $13.7 million and whose operations hit more than 1,000 organizations, including businesses, government offices, schools, and hospitals. Defense lawyers also suggested automated matching may have contributed to the detention, while Armenian authorities and the U.S. Justice Department had not publicly clarified the identity issue at the time of reporting.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
In January 2024, Australia, the United States, and the United Kingdom sanctioned Aleksandr Gennadievich Ermakov for links to cybercrime activity including the Medibank breach. The sanctions are cited as part of the paperwork that may have contributed to confusion with another man of a similar name.
The references state that the sanctioned Aleksandr Gennadievich Ermakov was linked to the 2022 Medibank breach. This linkage later became part of the identity dispute surrounding the Armenian detention.
U.S. charging material cited in the references alleges that an Aleksandr Ermakov participated in Sodinokibi/REvil ransomware attacks beginning around April 2019. The campaign reportedly went on to affect more than 1,000 entities, including businesses, government offices, schools, and hospitals.
On June 28, Armenian authorities detained Russian tourist Aleksandr Yuryevich Ermakov in Yerevan based on a U.S. extradition request tied to alleged REvil ransomware activity. His lawyers argued that he was not the sanctioned cybercriminal Aleksandr Gennadievich Ermakov and that the detention stemmed from insufficient identifying details in the request.
The U.S. charging material described in the references says the alleged participation of Aleksandr Ermakov in REvil attacks continued until July 12, 2021. An Interpol notice reportedly characterized him as a platform administrator who earned more than $13.7 million.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. authorities charged alleged **Sodinokibi/REvil** operators Yaroslav Vasinskyi of Ukraine and Yevgeniy Polyanin of Russia over ransomware attacks that included the compromise of Kaseya's remote management software, an intrusion that cascaded to managed service providers and their customers worldwide. The Kaseya incident was reported to have affected as many as **1,500 organizations**, with attackers allegedly encrypting systems, leaving ransom notes, and directing victims to Tor-based or public payment sites to obtain decryption keys; victims that did not pay were allegedly threatened with the publication or sale of stolen data. The Justice Department said Vasinskyi was arrested in Poland, later extradited to the United States, and arraigned in Texas on charges including conspiracy to commit computer fraud, damage to protected computers, and money laundering conspiracy. In parallel, U.S. authorities seized **$6.1 million** in alleged ransom proceeds tied to Polyanin, part of a broader multinational enforcement effort involving the FBI, Europol, Eurojust, and law enforcement partners across Europe and other allied countries to disrupt the REvil ransomware operation linked to the Kaseya attack.
Aug 14, 2026
U.S. authorities extradited Armenian national **Hambardzum Minasyan** to face charges for allegedly helping develop and operate the **RedLine** infostealer malware, a tool widely used to steal login credentials and other sensitive data from victims’ computers. Prosecutors accused Minasyan of maintaining key RedLine infrastructure, including virtual private servers, internet domains, malware distribution repositories, and a cryptocurrency account used to collect payments from affiliates who deployed the malware. The indictment charges Minasyan with conspiracy to commit access device fraud, conspiracy to violate the **Computer Fraud and Abuse Act**, and conspiracy to commit money laundering. The case follows the multinational **Operation Magnus** disruption of the RedLine and Meta infostealers in 2024, carried out with authorities in the United States, Belgium, the Netherlands, and **Eurojust**. U.S. officials had previously charged alleged co-conspirator **Maxim Rudometov**, identified as a RedLine developer and administrator, and also launched a public website for victims seeking information and assistance.
Jun 29, 2026
The United States sentenced **Yaroslav Vasinskyi** (`Rabotnik`), a Ukrainian affiliate of the **Sodinokibi/REvil** ransomware operation, to **13 years and 7 months** in prison for his role in more than **2,500 attacks** that collectively sought over **$700 million** in ransom payments. Prosecutors said the scheme encrypted victim networks, threatened to leak stolen data, and used cryptocurrency exchangers and mixing services to launder proceeds; the court also ordered more than **$16 million** in restitution. U.S. authorities said related forfeiture actions recovered assets including **39.89138522 Bitcoin** and **$6.1 million**, and credited cooperation with Polish authorities for Vasinskyi’s extradition and prosecution. In a separate but related enforcement action, **Deniss Zolotarjovs**, a Latvian national tied to the **Karakurt** extortion operation and linked by investigators to the broader **Conti** ecosystem, was sentenced to **102 months** in prison after U.S. prosecutors accused him of helping pressure victims with stolen data, reviving unresolved extortion cases, and laundering cryptocurrency. Authorities said the Russian-linked group targeted more than **54 companies worldwide**, including victims whose stolen records included sensitive medical information, and generated losses exceeding **$56 million** across 13 victims with roughly **$13 million** more paid by 41 additional companies. The cases underscore sustained cross-border law enforcement action against ransomware and data-extortion actors operating through Russia-linked criminal networks.
Jun 29, 2026