Armenian National Sentenced to Federal Prison for Ryuk Ransomware Operations

What Happened

Karen Vardanyan, a 35-year-old Armenian national, received a 24-month federal prison sentence followed by three years of supervised release for his involvement in Ryuk ransomware attacks. Indicted by a US grand jury in February 2024 on charges of conspiracy, fraud, and extortion, Vardanyan was apprehended in Ukraine in April 2025 and subsequently extradited to the United States in June 2025. He entered a guilty plea to conspiracy and computer fraud charges in July 2026.

Operational Context

According to Department of Justice findings, Vardanyan participated in Ryuk ransomware operations between March 2019 and June 2020. Law enforcement assessments indicate he functioned as a ransomware affiliate or initial access broker, facilitating network intrusions, lateral movement, and subsequent deployment of the Ryuk payload to extort victim organizations.

Impact and Financial Penalties

In addition to the custodial sentence, the court mandated that Vardanyan pay more than $1.2 million in direct restitution to impacted organizations. Because federal sentencing credits time served in pretrial detention following his 2025 extradition, Vardanyan has already completed a substantial portion of his 24-month term.

Defensive Takeaways

While this prosecution removes an active threat actor from the ecosystem, SecOps and sysadmins must maintain robust defensive controls against ransomware affiliates and initial access brokers:

• Monitor for credential harvesting, abuse of legitimate administrative tools, and unauthorized lateral movement.
• Implement rigorous segmentation to restrict internal network traffic and prevent widespread ransomware deployment.
• Maintain immutable, offline backups to ensure rapid recovery capabilities without yielding to extortion demands.