Ryuk ransomware operator gets 2-year sentence after extorting victims for $1.2 million
A key member of the Ryuk ransomware gang, Karen Vardanyan, has been sentenced to prison and ordered to pay restitution after orchestrating attacks that extorted over $1 million from victims worldwide, including hospitals and municipalities. The investigation revealed a coordinated effort by multiple individuals linked to the Ryuk group, highlighting the ongoing threat posed by this ransomware operation.
A 35-year-old Armenian national, Karen Vardanyan, was sentenced to two years in a U.S. federal prison and ordered to pay $1,219,106 in restitution following his guilty plea to charges related to multiple ransomware attacks. Vardanyan was extradited from Ukraine in July 2025 after being arrested in Kyiv. Prosecutors allege he was a core member of the Ryuk ransomware gang, responsible for launching over 2,400 attacks against victims globally, including state and local municipalities. These attacks significantly disrupted operations by restricting data access and impacting communications. During the height of the COVID-19 pandemic in 2020, Ryuk actors were specifically targeting hospitals, with Universal Health Services suffering a $67 million attack. The Department of Justice stated that Vardanyan and his team received at least $15 million in ransoms. The investigation revealed a network of individuals linked to the Ryuk group, including other arrests of Armenian and Ukrainian nationals involved in money laundering operations for the ransomware gang. A Russian man pleaded guilty in 2023 to laundering funds for Ryuk over a three-year period, alongside 13 unnamed co-conspirators. Ryuk ransomware was first detected in August 2018 and has been linked to Russian cybercriminals, including the Trickbot malware operation.