An Armenian national has been sentenced to two years in U.S. federal prison after pleading guilty to charges related to multiple ransomware attacks. Karen Vardanyan, 35, will also serve three years of supervised release and is required to pay $1,219,106 in restitution to the victims of his cyberattacks. He was extradited from Ukraine in July 2025 after being arrested in Kyiv.
Prosecutors identified Vardanyan as a core member of the Ryuk ransomware gang, stating that he and his co-conspirators executed over 2,400 ransomware attacks on victims worldwide, including state and local municipalities. The attacks significantly disrupted the operations of these entities by restricting access to data and impacting communications.
During the COVID-19 pandemic in 2020, the FBI and other U.S. agencies warned that Ryuk actors were heavily targeting hospitals. Notably, the hospital chain Universal Health Services suffered a Ryuk attack that ultimately cost the company $67 million. According to the Department of Justice (DOJ), Vardanyan and his team received at least $15 million in ransoms from their attacks over the years.
Vardanyan personally launched several ransomware attacks, extorting more than $1 million from victims before being placed on an international wanted list by the FBI. He pleaded guilty on July 8 to conspiracy and fraud in connection with computers. Ryuk, first detected in August 2018, has been linked to Russian cybercriminals, with U.S. officials dismantling the gang’s money laundering operations.
Several other members of the Ryuk group have been arrested in recent years, including another Armenian national and two Ukrainians. In 2023, a Russian man pleaded guilty in an Oregon federal court to laundering funds for Ryuk over three years, acting as a middleman for the group.
For more details, see the report by The Record.
Follow Cyber Warriors Middle East for further global cybersecurity developments.
