Ryuk Operator Karen Vardanyan Pleads Guilty to U.S. Ransomware Attacks
Summary
Karen Serobovich Vardanyan pleaded guilty to helping provide initial access and deploy Ryuk ransomware against U.S. organizations in 2019–2020. Prosecutors say the operation received about 1,610 bitcoins; sentencing is scheduled for September 2026.
Key points
- Vardanyan was arrested in Kyiv in April 2025 and extradited to the United States.
- He admitted helping provide initial access and deploy Ryuk ransomware against U.S. organizations between November 2019 and April 2020.
- Targets included a Michigan company, a technology company in Wilsonville, Oregon, and a Texas school.
- A Michigan victim paid 200 BTC, worth more than $1.1 million at the time, according to the article.
- The U.S. Department of Justice says Vardanyan and his co-conspirators received about 1,610 BTC in ransom payments, valued at roughly $15 million at the time.
- Vardanyan agreed to pay more than $1.1 million in restitution. Sentencing is scheduled for September 2026; he faces up to 15 years in prison on two charges.
Article Details
- Event Type
- Guilty plea in a Ryuk ransomware case
- Impact
- Court documents say Karen Serobovich Vardanyan helped gain initial access to U.S. corporate networks and deploy Ryuk between November 2019 and April 2020. The attacks affected hundreds of servers and workstations across multiple organizations, including companies and a school. Prosecutors say Vardanyan and his co-conspirators received about 1,610 bitcoins, valued at approximately $15 million at the time; one Michigan company paid 200 BTC, worth more than $1.1 million at the time.
MITRE ATT&CK
Threat Actors
ContiThe article describes Conti as a prolific hacker group that many former Ryuk members joined after the Ryuk operation shut down; Conti disbanded in 2022.Karen Serobovich VardanyanVardanyan pleaded guilty to helping illegally access U.S. corporate networks and deploy Ryuk ransomware between November 2019 and April 2020.RyukThe article describes the Ryuk ransomware operation as a gang that attacked organizations across multiple sectors and received ransom payments.
Malware
Countries
Industries
HealthcareThe Ryuk ransomware operation was active from 2018 until mid-2020, carrying out high-profile attacks against organizations across nearly every sector, including healthcare providers during the COVID-19 pandemic.TechnologyHe and his co-conspirators targeted multiple organizations, including a Michigan company, a technology company in Oregon, and a school in Texas, and received millions in bitcoin ransom payments.