Ryuk ransomware operator Karen Vardanyan sentenced to two years in U.S. prison, ordered to pay $1,219,106

Armenian national Karen Vardanyan, 35, received 24 months in prison, three years supervised release, and $1,219,106 restitution for Ryuk ransomware attacks; prosecutors say the wider conspiracy took in over $15 million.

Karen Serobovich Vardanyan, a 35-year-old Armenian national known online as Maneeken, was sentenced in U.S. federal court to 24 months in prison, three years of supervised release, and $1,219,106 in restitution after pleading guilty to conspiracy and computer fraud for his role in Ryuk ransomware attacks in 2019 and 2020; CyberScoop reported the supervised release will be followed by removal from the United States. Most outlets describe him as an initial-access provider or affiliate rather than a core developer, though The Record called him a core member. Sources agree he was arrested in Ukraine in April 2025, but they disagree on the extradition date — June 2025 per SecurityWeek versus July 2025 per The Record — and on the plea, which SecurityWeek places in July 2026 while CyberScoop says only July. The conduct window is given as March 2019–June 2020 by Cyber Security News and SecurityWeek, but November 2019–April 2020 by Security Affairs. The Record reported Vardanyan and co-conspirators launched more than 2,400 attacks worldwide and received at least $15 million; CyberScoop described hundreds of systems and about 1,160 bitcoin, versus about 1,610 bitcoin per Security Affairs. Vardanyan personally extorted over $1 million, including 200 bitcoin then worth more than $1.1 million from a Michigan company; other cited victims include an Oregon technology company, a Texas school, state and local municipalities, and the Universal Health Services hospital chain, whose 2020 Ryuk incident The Record said cost $67 million. Ryuk is attributed to the Wizard Spider gang and linked to Russian cybercriminals and Trickbot; BleepingComputer dates Ryuk activity to 2018–2020 before the group shifted to Conti, and Security Affairs estimates roughly $150 million in total Ryuk ransoms before that rebrand.

• Karen Serobovich Vardanyan, 35, Armenian national, alias 'Maneeken', sentenced to 24 months in U.S. federal prison.
• Sentence includes three years of supervised release and $1,219,106 in restitution; CyberScoop reports supervised release is followed by removal from the United States.
• Pleaded guilty to conspiracy and computer fraud.
• Agreed: arrested in Ukraine in April 2025. Disputed: extradition in June 2025 (SecurityWeek) vs July 2025 (The Record); plea in July 2026 (SecurityWeek) vs unspecified July (CyberScoop).
• Role disputed: initial-access provider or Ryuk affiliate (BleepingComputer, SecurityWeek, Security Affairs) vs core member (The Record).
• Conduct window disputed: March 2019–June 2020 (Cyber Security News, SecurityWeek) vs November 2019–April 2020 (Security Affairs).
• Prosecutors: over 2,400 Ryuk attacks worldwide and at least $15 million in ransoms (The Record); bitcoin haul reported as about 1,160 BTC (CyberScoop) vs about 1,610 BTC (Security Affairs).
• Vardanyan personally extorted over $1 million, including 200 bitcoin then worth more than $1.1 million from a Michigan company.