Armenian man extradited to U.S. faces charges for role in infostealing malware scheme

Date: March 25, 2026

Contact: [email protected]

Austin, TX - An Armenian man made his initial appearance in an Austin federal court Tuesday after being extradited to the U.S. on criminal charges related to his alleged role in an infostealer scheme, announced U.S. Attorney for the Western District of Texas, Justin R. Simmons.

According to court documents, Hambardzum Minasyan allegedly conspired with others to enrich himself by developing and administering RedLine, one of the most prevalent infostealing malware variants in the world, which has previously been used to conduct intrusions against major corporations. When executed, RedLine would steal data, including access devices, from victims' computers.

A three-count indictment alleges the conspirators maintained digital infrastructure, including C2 servers and administrative panels to enable the deployment of the malware by affiliates, and collected payments from RedLine affiliates, allowing the affiliates to use the infostealer against victims. Additionally, they allegedly responded to questions and requests from actual and potential RedLine affiliates, conspired with each other and affiliates to steal and possess the financial information, including access devices, of victims, and laundered the proceeds of cybercrime through cryptocurrency exchanges and other means.

The indictment alleges that Minasyan registered two virtual private servers to host portions of RedLine's infrastructure as well as two internet domains in support of the RedLine scheme. He also allegedly created repositories on an online file sharing site that were used to distribute RedLine to affiliates. In Nov. 2021, he allegedly registered a cryptocurrency account that was used to receive payments from RedLine affiliates.

In Oct. 2024, the Department of Justice joined the Netherlands, Belgium, Eurojust and other partners in announcing an international disruption effort against the current version of RedLine Infostealer. At the same time, the Justice Department unsealed charges against alleged co-conspirator Maxim Rudometov, one of the developers and administrators of RedLine Infostealer.

Minasyan is charged with conspiracy to commit access device fraud, conspiracy to violate the Computer Fraud and Abuse Act, and conspiracy to commit money laundering. If convicted, he faces up to 10 years in prison for access device fraud and up to 20 years in prison for the other two counts. A federal district court judge will determine any sentence after considering the U.S. Sentencing Guidelines and other statutory factors.

This is a joint investigation by IRS Criminal Investigation, the FBI Austin Cyber Task Force, which consists of the Naval Criminal Investigative Service, the DoD Office of Inspector General's Defense Criminal Investigative Service, and Army Criminal Investigation Division, among other agencies.

Assistant U.S. Attorney Kirk Mangels is prosecuting the case. The Justice Department's Office of International Affairs secured the arrest and March 23 extradition of Minasyan and provided significant assistance throughout the investigation. The Criminal Division's International Computer Hacking and Intellectual Property (ICHIP) attorney advisor, who is based at Eurojust in The Hague, also provided assistance.

The Justice Department provides cybercrime technical assistance to foreign law enforcement, prosecutorial, and judicial partners in other countries through the ICHIP program.

IRS-CI is the law enforcement arm of the IRS, responsible for conducting financial crime investigations, including tax fraud, narcotics trafficking, money laundering, public corruption, healthcare fraud, identity theft and more. It is the only federal law enforcement agency with investigative jurisdiction over violations of the Internal Revenue Code. IRS-CI has 18 field offices located across the U.S. and maintains an international presence through attaché posts abroad.