Ryuk Member Gets 2 Years for $1.2M Ransomware Attacks

Confirmed. Karen Vardanyan, an Armenian national, sentenced to two years in US federal prison for his role in Ryuk ransomware attacks against US victims. Restitution: over $1.2 million, payable to named victims. The Record and SecurityWeek both confirm the sentence and affiliation.

Case details

Sentence: 24 months federal. Restitution: $1.2M+. Vardanyan’s specific technical role inside the operation and how US custody was established are not detailed in the publicly available record at publication time. Confidence on those specifics: unconfirmed.

Ryuk background

Ryuk operated from roughly 2018 through 2021, targeting hospitals, schools, and municipal governments with high-value ransom demands in the millions per victim. The FBI and CISA issued a joint advisory in October 2020 flagging Ryuk as an active threat to the US healthcare and public health sector. Attribution by multiple government and private-sector sources links the group to a Russia-based criminal organization. Vardanyan is Armenian by nationality; whether he operated inside Russia or abroad has not been publicly stated.

Enforcement pattern

US prosecution of named ransomware operators has continued through 2026. September sentencings now include Vardanyan and Ukrainian Conti developer Oleksii Lytvynenko, who received four years earlier this month after extradition from Ireland. Coverage: Ukrainian Conti Developer Gets 4 Years in US Prison.

CISA separately flagged active ransomware exploitation of enterprise infrastructure this week. Coverage: CISA: Ransomware Gangs Exploiting TeamCity RCE Flaw.

Full ransomware enforcement and incident coverage: ransomware hub.