ARMENIAN national Karen Vardanyan, 35, has been sentenced to 24 months in a US federal prison for his role in Ryuk ransomware attacks against American organisations. He was also given three years of supervised release and ordered to pay $1,219,106 in restitution. Vardanyan, who used the online aliases “Maneeken” and “Karl Lagerfeld”, was extradited from Ukraine after being arrested there in 2025. The US Department of Justice said he pleaded guilty in July.
According to the article, Vardanyan provided initial access to corporate networks between November 2019 and April 2020, helping attackers deploy Ryuk across hundreds of servers and workstations. The ransomware encrypted victims’ data and demanded Bitcoin for decryption keys. Reported victims included a Michigan company that paid 200 Bitcoin, worth more than $1.1 million at the time, an Oregon company and a Texas school.
The wider group is believed to have collected about 1,610 Bitcoin, valued at more than $15 million when payments were made. The FBI investigated the case, while the Justice Department’s Office of International Affairs handled the extradition, with Ukrainian authorities assisting. The article identifies Ryuk’s operators as Wizard Spider and says the group later became associated with Conti.