An Armenian man involved in Ryuk ransomware attacks against U.S. companies has been sentenced to 24 months in prison followed by three years of supervised release.
Karen Serobovich Vardanyan, 35, who also used the online aliases “Maneeken” and “Karl Lagerfeld,” specialized in gaining initial access to corporate networks before ransomware was deployed. He pleaded guilty in July after being extradited to the United States from Kyiv, Ukraine, following his arrest in April 2025.
According to court documents, Vardanyan and his associates hacked multiple U.S. organizations between March 2019 and around June 2020 as part of Ryuk ransomware attacks. The attackers gained access to corporate networks and deployed ransomware across hundreds of servers and workstations.
One of the attacks targeted a company in Michigan, which paid 200 Bitcoin, worth more than $1.1 million at the time. Prosecutors also identified a school in Texas and a technology company in Wilsonville, Oregon, among the victims.
The U.S. Department of Justice said Vardanyan and his co-conspirators received approximately 1,610 Bitcoin in ransom payments from victim organizations, valued at more than $15 million when the payments were made.
Ryuk operated as a ransomware-as-a-service operation from 2018 until around mid-2020 and became particularly known for attacks against large organizations, including healthcare providers during the COVID-19 pandemic. At its peak, the operation was reportedly attacking around 20 organizations each week and collected more than $150 million in ransom payments.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
After Ryuk disappeared in 2020, the cybercrime group associated with the operation, known as Wizard Spider, moved on to the Conti ransomware operation. Conti later shut down in 2022 following the leak of its internal communications and source code. Former members subsequently split into smaller groups and became involved with other ransomware operations.
