The participant of one of the largest operations with Ryuk received in the United States two years in prison years after the campaign, which is attributed to thousands of attacks and more than $100 million in ransoms.
The Federal Court of Oregon sentenced 35-year-old Armenian citizen Karen Vardanyan to 24 months in prison and three years of supervision after his release. Vardanyan also has to pay the victims $1 219 106. Ryuk belongs to the generation of ransomware that operators have launched after entering the corporate network and obtaining sufficient privileges.
Vardanyan used the aliases Maneeken and Karl Lagerfeld. According to the materials of the American case, from March 2019 to about June 2020, he participated in a conspiracy, whose participants penetrated into networks of companies, schools and other organizations, encrypted servers and workstations, and then demanded bitcoins for the decryption keys.
Ryuk was particularly active in attacking organizations for which a long simple one could have serious consequences. Among the goals were municipalities, educational institutions, critical infrastructure and medical organizations. At the height of the pandemic, U.S. agencies separately warned hospitals about the increased activity of ransomware operators.
In one episode, the Michigan company handed over 200 BTC to criminals who were worth more than $1.1 million at the time of payment. The investigation also linked Vardanyan to an attack on a technology company in Oregon and a school in Texas. American prosecutors pointed out that the accused participants of the scheme received about 1610 BTC worth more than $15 million at the time of payments.
The scale of the entire operation was considerably larger than a particular American case. During the extradition of Vardanyan, the Ukrainian prosecutor's office reported more than 2400 cyberattacks in different countries and total payments of more than $100 million. Ukrainian law enforcement officers detained Vardanyan in Kyiv in April 2025, and handed over to the American side on June 18.
In July 2026, Vardanyan pleaded guilty to conspiracy and computer fraud. On September 22, the court appointed him two years in federal prison. The investigation was conducted by the FBI with the assistance of the Ukrainian authorities and the Office of International Affairs of the Ministry of Justice.
The financial trace of Ryuk law enforcement agencies has been dealt with for several years. In 2023, Russian citizen Denis Dubnikov pleaded guilty in the U.S. to money laundering case from Ryuk victims. The investigation linked him with the transfer of part of the ransom through cryptocurrency services.
The story of Ryuk is closely intertwined with another major extortional operation. The specialists associated the infrastructure and participants of Ryuk with TrickBot and the subsequent development of Conti. In September 2026, Conti member Alexei Litvinenko received four years in prison in the United States.
Ryuk was one example of how encryptors turned from separate malware into a distributed criminal business. A detailed history of ransomware shows how access brokers, negotiators, infrastructure operators and individual ransom laundering specialists have emerged next to the developers.
The Federal Court of Oregon sentenced 35-year-old Armenian citizen Karen Vardanyan to 24 months in prison and three years of supervision after his release. Vardanyan also has to pay the victims $1 219 106. Ryuk belongs to the generation of ransomware that operators have launched after entering the corporate network and obtaining sufficient privileges.
Vardanyan used the aliases Maneeken and Karl Lagerfeld. According to the materials of the American case, from March 2019 to about June 2020, he participated in a conspiracy, whose participants penetrated into networks of companies, schools and other organizations, encrypted servers and workstations, and then demanded bitcoins for the decryption keys.
Ryuk was particularly active in attacking organizations for which a long simple one could have serious consequences. Among the goals were municipalities, educational institutions, critical infrastructure and medical organizations. At the height of the pandemic, U.S. agencies separately warned hospitals about the increased activity of ransomware operators.
In one episode, the Michigan company handed over 200 BTC to criminals who were worth more than $1.1 million at the time of payment. The investigation also linked Vardanyan to an attack on a technology company in Oregon and a school in Texas. American prosecutors pointed out that the accused participants of the scheme received about 1610 BTC worth more than $15 million at the time of payments.
The scale of the entire operation was considerably larger than a particular American case. During the extradition of Vardanyan, the Ukrainian prosecutor's office reported more than 2400 cyberattacks in different countries and total payments of more than $100 million. Ukrainian law enforcement officers detained Vardanyan in Kyiv in April 2025, and handed over to the American side on June 18.
In July 2026, Vardanyan pleaded guilty to conspiracy and computer fraud. On September 22, the court appointed him two years in federal prison. The investigation was conducted by the FBI with the assistance of the Ukrainian authorities and the Office of International Affairs of the Ministry of Justice.
The financial trace of Ryuk law enforcement agencies has been dealt with for several years. In 2023, Russian citizen Denis Dubnikov pleaded guilty in the U.S. to money laundering case from Ryuk victims. The investigation linked him with the transfer of part of the ransom through cryptocurrency services.
The story of Ryuk is closely intertwined with another major extortional operation. The specialists associated the infrastructure and participants of Ryuk with TrickBot and the subsequent development of Conti. In September 2026, Conti member Alexei Litvinenko received four years in prison in the United States.
Ryuk was one example of how encryptors turned from separate malware into a distributed criminal business. A detailed history of ransomware shows how access brokers, negotiators, infrastructure operators and individual ransom laundering specialists have emerged next to the developers.
