Karen Vardanyan Sentenced in Ryuk Ransomware Case

A US court sentenced Karen Vardanyan to two years in prison followed by three years of supervised release for his role in Ryuk ransomware attacks, and ordered him to pay about $1.2 million in restitution to victims. The 35-year-old Armenian national pleaded guilty in July 2026 to computer-related conspiracy and fraud offenses, according to reports on the case. The sentence follows Vardanyan’s extradition from Ukraine to the United States in 2025. Prosecutors said he and co-conspirators illegally accessed computer networks and deployed Ryuk ransomware on compromised systems. The attacks described in court records affected US organizations between 2019 and 2020, including a Michigan company, a Texas school and a technology company in Oregon. In the Michigan incident, the victim paid a ransom, according to court records cited in reports. Prosecutors said Vardanyan and his co-conspirators received ransom payments worth more than $15 million at the time they were paid. Reports give incompatible figures for the amount of bitcoin involved, so the bitcoin total could not be established from the available accounts.