Court sentences Armenian Ryuk operator Karen Vardanyan to two years
First coverage.
A U.S. court sentenced Armenian national Karen Vardanyan, 35, to two years for Ryuk ransomware activity and ordered $1,219,106 in restitution.
Karen Vardanyan, a 35-year-old Armenian national also known as Maneeken, was sentenced in U.S. federal court to 24 months in prison, three years of supervised release, and $1,219,106 in restitution after pleading guilty to conspiracy and computer fraud tied to Ryuk ransomware. The Justice Department and court records describe 2019 and 2020 attacks on U.S. organizations, including a Michigan company that paid nearly $1.2 million, reported as 200 bitcoin then worth over $1.1 million, plus an Oregon technology company and a Texas school; one account adds that he will be removed from the United States after supervision. Sources disagree on his role and the conspiracy's scale: The Record called him a core member and cited more than 2,400 attacks and at least $15 million in ransoms, while later reports describe an affiliate or initial-access provider and put the haul at about 1,160 or 1,610 bitcoin, then worth more than $15 million. Arrest timing also conflicts, with one report saying he was arrested in Kyiv and extradited in July 2025 and another saying he was arrested in April 2025, extradited in June 2025, and pleaded guilty in July 2026. Reported activity dates range from March 2019-June 2020 to November 2019-April 2020. Ryuk, first seen in 2018, has been linked to Russian cybercriminals, Trickbot, and Wizard Spider, with one estimate of about $150 million in ransoms before operators rebranded as Conti, and a 2020 Universal Health Services incident separately cited as costing $67 million.
- Karen Vardanyan, 35, an Armenian national also known as Maneeken, was sentenced to 24 months in U.S. federal prison, three years of supervised release, and $1,219,106 in restitution after pleading guilty to conspiracy and computer fraud.
- Court records cite a Michigan company that paid nearly $1.2 million (200 bitcoin, then worth over $1.1 million), an Oregon technology company, and a Texas school; one account says removal from the United States follows supervision.
- Sources disagree on role and scale: some call him a core Ryuk member tied to more than 2,400 attacks and at least $15 million, while others describe an affiliate or initial-access provider and cite about 1,160 or 1,610 bitcoin then worth…
- Arrest timing conflicts: one report says he was arrested in Kyiv and extradited in July 2025; another says arrested in Ukraine in April 2025, extradited in June 2025, and pleaded guilty in July 2026.
- Activity windows also differ, from March 2019-June 2020 to November 2019-April 2020, within broader 2019-2020 Ryuk attacks.
- Co-conspirators were described as two Ukrainian nationals and another Armenian national.
- Ryuk, first seen in 2018, was linked to Russian cybercriminals, Trickbot, and Wizard Spider; one report estimates about $150 million before a Conti rebrand, and a 2020 Universal Health Services incident was cited as a $67 million loss.
Coverage
oldest first · one row per article · UTC- · Sep 23, 2026
The RecordFirst report
Ryuk ransomware operator gets 2-year sentence after extorting victims for $1.2 million
A Ryuk ransomware operator was sentenced to 2 years in prison for extorting over $1.2 million from victims.
- · Sep 23, 2026
Ryuk ransomware operator gets 2-year sentence after extorting victims for $1.2 million
An Armenian Ryuk operator received a two-year U.S. prison sentence and $1.2 million in victim restitution.