Ryuk Ransomware Member Sentenced to Two Years in Prison

A Ryuk ransomware member has received a 24-month prison sentence for his role in attacks on US organizations. Karen Serobovich Vardanyan will also serve three years of supervised release.

Vardanyan Helped Breach US Networks

Vardanyan, a 35-year-old Armenian national, specialized in gaining access to corporate networks. Online, he used the names “Maneeken” and “Karl Lagerfeld.”

Authorities arrested him in Kyiv in April 2025 and later extradited him to the United States. He pleaded guilty in July 2026.

According to court documents, Vardanyan and his accomplices attacked several US organizations between March 2019 and June 2020. They accessed victim networks and deployed Ryuk ransomware on hundreds of servers and workstations.

One Michigan company paid 200 Bitcoin, worth more than $1.1 million at the time. Prosecutors also identified a Texas school and a technology company in Oregon among the victims.

The Ryuk ransomware member took part in a campaign that prosecutors say brought the group about 1,610 Bitcoin in ransom payments. Those payments were worth more than $15 million at the time.

Ryuk Attacks Continued During the Pandemic

Ryuk operated from 2018 until around mid-2020. During the COVID-19 pandemic, its attacks on healthcare organizations drew particular attention.

At its peak, the group reportedly attacked about 20 organizations each week. Researchers estimated that Ryuk collected more than $150 million in ransom payments.

After Ryuk shut down, the Wizard Spider cybercrime group behind it moved to Conti ransomware. Conti later became a major threat, but it disbanded in 2022 after its internal chats and source code leaked. Its members then split into smaller groups or joined other ransomware operations.