Karen Vardanyan Sentenced in Ryuk Ransomware Case

A US court sentenced Karen Vardanyan to two years in prison followed by three years of supervised release for his role in Ryuk ransomware attacks, and ordered him to pay about $1.2 million in restitution to victims. The 35-year-old Armenian national pleaded guilty in July 2026 to computer-related conspiracy and fraud offenses, according to reports on the case.

The sentence follows Vardanyan’s extradition from Ukraine to the United States in 2025. Prosecutors said he and co-conspirators illegally accessed computer networks and deployed Ryuk ransomware on compromised systems. The attacks described in court records affected US organizations between 2019 and 2020, including a Michigan company, a Texas school and a technology company in Oregon.

In the Michigan incident, the victim paid a ransom, according to court records cited in reports. Prosecutors said Vardanyan and his co-conspirators received ransom payments worth more than $15 million at the time they were paid. Reports give incompatible figures for the amount of bitcoin involved, so the bitcoin total could not be established from the available accounts.

The restitution order is separate from that alleged ransom total and is...