Ransomware · Incident Response
Armenian Man Sentenced to US Prison for Ryuk Ransomware Attacks
Karen Vardanyan, an Armenian national, has been sentenced to 24 months in US prison for his role in Ryuk ransomware attacks and ordered to pay over $1.2 million in restitution.
Ross GrantUpdated 3 min read
The short version
A man from Armenia has been sentenced to two years in a US prison for helping carry out Ryuk ransomware attacks. He was involved in breaking into computer systems and demanding money from victims. The court also ordered him to pay over $1.2 million to those affected. This case shows that people involved in ransomware can be caught and prosecuted, even if they operate from other countries.
By the numbers
- 24 monthsprison sentence for Karen VardanyanSecurityWeek
- $1.2 millionrestitution ordered to be paid to victimsSecurityWeek
- 3 yearssupervised release after prison termSecurityWeek
What happened?
Karen Vardanyan, a 35-year-old Armenian national, was sentenced by a US court to 24 months in prison for his role in Ryuk ransomware attacks between 2019 and 2020. He was arrested in Ukraine in 2025, extradited to the US, and pleaded guilty in 2026. He must also pay over $1.2 million in restitution to victims.
Who was sentenced and for what?
Karen Vardanyan, a 35-year-old Armenian citizen, has been sentenced by a US court to 24 months in federal prison for his involvement in Ryuk ransomware attacks. The sentencing follows his guilty plea to charges of conspiracy and computer fraud. The US Department of Justice announced the outcome, stating that Vardanyan was involved in attacks that took place between March 2019 and June 2020. After serving his prison term, he will also face three years of supervised release. He has been ordered to pay more than $1.2 million in restitution to the victims of these attacks. SecurityWeek (opens in a new tab)
Timeline: Arrest, extradition, and sentencing
Vardanyan was charged by a US grand jury in February 2024. He was arrested in Ukraine in April 2025 and extradited to the United States in June 2025. He pleaded guilty in July 2026. Because he has been in custody since his extradition, much of his 24-month sentence has already been served.
What was his role in the attacks?
According to the authorities, Vardanyan was likely not a core developer of the Ryuk ransomware itself. Instead, he is believed to have acted as an affiliate or an initial access provider. Affiliates are people who help spread ransomware or gain access to victims' systems, while the main operators run the infrastructure and handle the ransom payments. Vardanyan extorted more than $1 million from several victims using ransomware.
The wider crackdown on ransomware
Vardanyan's sentencing is part of a broader effort to prosecute those involved in ransomware operations. In the same year, a Ukrainian developer linked to the Conti ransomware received a four-year prison sentence in the US. Another Ukrainian, accused of creating several ransomware families (Lockergoga, MegaCortex, and Nefilim), was sentenced to 13 years by a Swiss court. These cases show that law enforcement agencies are increasingly able to arrest and extradite suspects from other countries, even when the crimes are committed online and across borders.
What is Ryuk ransomware?
Ryuk is a type of ransomware that has been used in high-profile attacks against organisations worldwide. Ransomware is malicious software that encrypts a victim's files, making them inaccessible until a ransom is paid. Ryuk has been linked to attacks on hospitals, schools, and businesses, often demanding large sums of money. Affiliates like Vardanyan play a key role in these operations by helping to break into networks and deploy the malware.
What should organisations do?
This case highlights the importance of strong cybersecurity defences and incident response plans. Organisations should ensure they have up-to-date backups, use multi-factor authentication, and train staff to recognise phishing attempts. Quick detection and response can limit the damage from ransomware attacks. Law enforcement's success in this case also shows that reporting incidents and cooperating with authorities can lead to arrests and restitution for victims.
Claimed vs confirmed
- Confirmed
Karen Vardanyan was involved in Ryuk ransomware attacks as an affiliate or initial access provider.
Authorities described Vardanyan's role as likely being an affiliate or initial access provider, not a core developer.
The impact
- Money
- Vardanyan was ordered to pay over $1.2 million in restitution. Under US law, cybercrime convictions can also lead to further fines and asset seizures. Ransomware attacks often cause significant financial losses for victims.
- Reputation
- This case shows that law enforcement can identify, extradite, and prosecute ransomware affiliates, which may deter others. It also demonstrates ongoing international cooperation against cybercrime.
- Customers
- Victims of ransomware may lose access to critical data and face business disruption. Organisations are reminded to have backups and incident response plans, and to report incidents to authorities.
Why it matters
Ransomware attacks can disrupt businesses, hospitals, and schools, causing financial and operational damage. This sentencing shows that law enforcement can reach cybercriminals across borders and hold them accountable. It also highlights the ongoing threat of ransomware and the need for strong defences.
How does it work?
Ransomware is malicious software that encrypts files on a victim's computer, making them inaccessible until a ransom is paid. Affiliates or initial access providers help attackers gain entry to networks, after which the ransomware is deployed and victims are extorted for payment.
Key points
- A 35-year-old Armenian man was sentenced to 24 months in US prison for Ryuk ransomware attacks.
- He must pay over $1.2 million in restitution to victims.
- He acted as an affiliate or initial access provider, not the main developer.
- Law enforcement is increasingly able to extradite and prosecute ransomware suspects.
- Organisations should strengthen defences and incident response plans against ransomware.
Sources
SecurityWeek
Reference
