← Back to SecLog

Ryuk ransomware operator pleads guilty in U.S. over attacks on American companies, school, and servers

Updated: 2026.09.24 1M ago 6 sources
Policy & Regulation Threat Actors & APTs Ransomware
A man accused of helping deploy Ryuk ransomware against U.S. victims has pleaded guilty in federal court after being extradited from Ukraine. U.S. prosecutors say Karen Serobovich Vardanyan provided initial access to corporate networks and helped deploy Ryuk between November 2019 and April 2020, encrypting hundreds of servers and workstations. Court records cited attacks including a Michigan company, a technology company in Oregon, and a school in Texas, with the conspirators allegedly receiving about 1,610 bitcoin in ransom payments.
Why it matters: This matters because it ties a named individual to one of the most damaging ransomware operations and shows continued prosecution years after the attacks. Defenders and affected sectors should treat it as a reminder that initial-access brokers and old Ryuk tradecraft still shape current ransomware threats descended from Ryuk and Conti.

Sources

US Court Sentences Armenian Man to Prison for Ryuk Ransomware Attacks
Eduard Kovacs 2026.09.24 97% relevant
This is a direct update on the same defendant and case: Karen Vardanyan, previously reported as pleading guilty, has now been sentenced to 24 months in prison and ordered to pay more than $1.2 million in restitution for his role in Ryuk attacks carried out between 2019 and 2020.
Ryuk ransomware operator gets 2-year sentence after extorting victims for $1.2 million
2026.09.23 98% relevant
This is a direct update on the same defendant and case, adding the sentencing outcome: Karen Vardanyan received a two-year federal prison sentence, three years of supervised release, and $1,219,106 in restitution after pleading guilty in July.
Ryuk ransomware operator gets 2-year sentence after extorting victims for $1.2 million
2026.09.23 96% relevant
This updates the same underlying case involving Karen Vardanyan, adding that he has now been sentenced to two years in prison, ordered to pay about $1.2 million in restitution, and was described by prosecutors as a core Ryuk member tied to more than 2,400 attacks and at least $15 million in ransom proceeds.
Ryuk ransomware member sentenced to 24 months in prison
Sergiu Gatlan 2026.09.23 97% relevant
This is a direct update to the same case: the Armenian Ryuk initial-access actor Karen Vardanyan who previously pleaded guilty has now been sentenced to 24 months in prison and 3 years of supervised release.
Ryuk ransomware member pleads guilty in the US, faces 15 years in prison
Bill Toulas 2026.07.10 100% relevant
This article establishes a distinct law-enforcement story centered on Karen Vardanyan's guilty plea for his role in the Ryuk ransomware operation, not a previously tracked plea or breach event.
Ryuk operator pleads guilty; Blackcat/AlphV conspirator gets nearly 6-year sentence
2026.07.10 97% relevant
This article directly updates that same Ryuk criminal case with the guilty plea by Karen Serobovich Vardanyan, additional detail on victim organizations in Michigan, Oregon, and Texas, the 200 bitcoin payment, restitution, and sentencing timeline.
← Back to all stories