Ryuk Ransomware Operator Sentenced to Two Years for Global Extortion Scheme
An Armenian national has been sentenced to federal prison for his role in the Ryuk ransomware conspiracy, which extorted over $1 million from victims worldwide.
Karen Vardanyan, 35, an Armenian citizen extradited from Ukraine, has been sentenced to 24 months in prison and ordered to pay over $1.2 million in restitution for his involvement in a Ryuk ransomware operation. The sentence, handed down by the U.S. Attorney’s Office for the District of Oregon, concludes a chapter in the global fight against one of the most disruptive ransomware families.
Vardanyan operated under online aliases including "Maneeken" and "Karl Lagerfeld" between March 2019 and June 2020. During this period, he participated in a conspiracy that deployed the Ryuk ransomware against numerous organizations across the globe. The malware's primary function was to encrypt victim files, rendering critical data inaccessible and disrupting operations. This encryption was a prelude to demanding substantial cryptocurrency payments, typically Bitcoin, in exchange for decryption keys or the promise of data restoration.
The scope of the conspiracy was extensive, targeting a wide array of entities including companies, educational institutions, and other organizations. Court documents reveal that the group successfully extorted over $1 million from its victims. Among the identified victims was a company based in Wilsonville, Oregon, underscoring the domestic impact of these international cybercriminal enterprises.
This case highlights the increasingly transnational nature of sophisticated ransomware attacks. Threat actors frequently leverage remote infrastructure, online anonymity tools, and cryptocurrency to obscure their identities and launder illicit gains, making attribution and prosecution challenging. Vardanyan's extradition from Ukraine to the United States demonstrates significant international cooperation in bringing such individuals to justice.
Federal charges against Vardanyan included conspiracy, computer fraud, and computer extortion. He was indicted by a federal grand jury in Portland in February 2024 and made his initial court appearance in June 2025. Following his guilty plea to conspiracy and computer fraud charges in July 2026, the sentencing marks a significant outcome for law enforcement agencies involved.
The Ryuk ransomware, known for its targeted attacks on high-value enterprises, often aimed to maximize pressure on victims by exploiting the critical nature of their operations. The disruption caused by such attacks can have far-reaching consequences, impacting business continuity, customer services, data availability, and the integrity of backup systems.
To combat the persistent threat of ransomware, security experts recommend a multi-layered defense strategy. This includes maintaining robust, offline, and regularly tested backups; implementing multi-factor authentication; promptly patching internet-facing systems; enforcing strict access controls; and continuous network monitoring for suspicious activities such as rapid file encryption. Early detection of indicators like unusual credential usage or disabled security controls is crucial.
The investigation was led by the FBI, with prosecution handled by Assistant U.S. Attorney Katherine Rykken. The Justice Department’s Office of International Affairs played a key role in securing Vardanyan’s arrest and extradition, with significant cooperation from Ukrainian authorities.
The sentencing of Karen Vardanyan, 35, to two years in federal prison and over $1.2 million in restitution provides further detail on the Ryuk ransomware gang's operations. Vardanyan, extradited from Ukraine, was accused of being a core member responsible for over 2,400 attacks, personally extorting more than $1 million. Prosecutors noted his involvement in a group that received at least $15 million in ransoms, highlighting the significant financial impact of Ryuk's activities, including a $67 million hit to Universal Health Services.
The sentencing of Karen Vardanyan to two years in prison and approximately $1.2 million in restitution marks a significant development in the prosecution of Ryuk ransomware operators. While the initial article covered his guilty plea and role in the conspiracy, this sentencing confirms the legal resolution and financial penalties imposed. Vardanyan's plea agreement and subsequent sentence align with the prosecution's efforts to hold individuals accountable for their integral, though not necessarily leading, roles in large-scale ransomware operations.