A federal court has handed down a prison sentence to an Armenian national extradited from Ukraine for his role in one of the most damaging ransomware operations of the early 2020s. Karen Vardanyan, 35, was sentenced to 24 months in federal prison followed by three years of supervised release for his part in a conspiracy that deployed Ryuk ransomware against organizations around the world, according to the U.S. Attorney’s Office for the District of Oregon. The court also ordered him to pay $1,219,106 in restitution to victims of the scheme.

Vardanyan was linked to a conspiracy that ran Ryuk ransomware campaigns against victim networks between March 2019 and roughly June 2020, a period during which Ryuk was one of the most active and disruptive ransomware families targeting enterprise networks globally. Prosecutors say he operated under the online aliases “Maneeken” and “Karl Lagerfeld” while participating in the operation.

How the Ryuk Operation Worked

Ryuk followed the now-familiar ransomware playbook: once operators gained access to a victim’s network, the malware encrypted files and disrupted access to computers and servers, after which the attackers demanded payment — typically in Bitcoin — in exchange for restoring access or supplying decryption tools. Court records indicate the conspiracy targeted a broad mix of victims, including companies and schools, and extorted more than $1 million from several of them collectively.

One identified victim in the case was a company based in Wilsonville, Oregon, which is part of why the prosecution was handled out of the District of Oregon despite the international scope of the underlying conspiracy.

The Path to Sentencing

The case moved through several stages before reaching sentencing. A federal grand jury in Portland returned a superseding indictment against Vardanyan on February 22, 2024, charging him with conspiracy, computer fraud, and computer extortion. He was subsequently extradited from Ukraine and made his first appearance in U.S. federal court on June 20, 2025, at which point a magistrate judge ordered him detained. Just over a year later, on July 8, 2026, Vardanyan pleaded guilty to conspiracy and computer fraud charges, setting up the sentencing that has now been handed down.

The Federal Bureau of Investigation led the investigation, with Assistant U.S. Attorney Katherine Rykken prosecuting the case. The Justice Department’s Office of International Affairs assisted in securing Vardanyan’s arrest and extradition, and U.S. authorities specifically credited Ukrainian law enforcement for its cooperation — a notable detail given the ongoing geopolitical backdrop and the frequent difficulty of securing extraditions of cybercrime suspects from countries in that region.

Why Ryuk Still Matters

Although the underlying attacks took place several years ago, Ryuk’s legacy is still relevant to how organizations think about ransomware risk today. Its operators and affiliates specifically sought out high-value targets where an operational outage would create maximum pressure to pay quickly, a targeting strategy that has since become standard across the ransomware-as-a-service ecosystem. Cases like this one also illustrate the increasingly international structure of major ransomware operations, in which threat actors spread across multiple countries, rely on cryptocurrency to obscure payment flows, and use online aliases and intermediaries to distance themselves from the intrusions.

Reducing Ransomware Exposure

Prosecutors and investigators pointed to a familiar but still under-implemented set of defensive practices that reduce an organization’s exposure to ransomware campaigns of this type:

• Maintain offline, regularly tested backups that are isolated from the production network.
• Deploy multi-factor authentication across remote access points and privileged accounts.
• Patch internet-facing systems promptly, since initial access in many ransomware cases still traces back to a known, unpatched vulnerability.
• Restrict privileged access and monitor for unusual credential use or disabled endpoint security controls.
• Watch for rapid, large-scale file-renaming activity, which is often one of the earliest visible signs of an encryption event already in progress.

Security teams should also treat unauthorized remote access attempts and unexplained changes to endpoint protection tooling as high-priority alerts, since both are common precursors to the kind of network-wide encryption event that made Ryuk so costly for its victims.