Armenia Detains a Russian Namesake of the Wanted REvil Hacker

Since June 28, Armenian authorities have held Russian tourist Alexander Ermakov in a pretrial detention center. The grounds are a US extradition request — American authorities are searching for a man of the same name in a case involving alleged ties to the REvil ransomware group.

The man's wife, Maria Yurova, described the detention in an interview with the REN TV channel. According to her, border guards led Ermakov out of the departure hall at Zvartnots Airport in Yerevan. Officers showed him a photo on a phone, taken from a VKontakte page, and took him away to a separate room.

The detainee's lawyers insist that the American authorities have made a mistake in identification and that the wanted REvil hacker is a different person who merely bears the same name. In the defense's version, the matching first and last name is what led to the detention of a tourist who has nothing to do with cybercrime.

REvil was one of the most notorious ransomware groups of recent years: its record includes attacks on major companies and demands for multimillion-dollar ransoms to decrypt data and keep stolen information from being disclosed. Law enforcement agencies in several countries, including the United States, have spent years pursuing the group's members and accomplices, and in 2022 Russia reported the detention of a number of individuals linked to REvil under its own criminal cases.

The case of the tourist detained in Armenia highlights the risks associated with international extradition requests when the identification of wanted individuals is not precise enough. It has not yet been reported when the Armenian court will consider the extradition question or what evidence the parties will present to confirm or refute the detainee's identity.

Source: The Hacker News