KAREN Vardanyan, a 35-year-old Armenian national, has been sentenced by a US court to 24 months in federal prison for his role in Ryuk ransomware attacks. He will also serve three years of supervised release and pay more than $1.2 million in restitution. Vardanyan was charged in February 2024 with conspiracy, fraud and computer-related extortion. He was arrested in Ukraine in April 2025, extradited to the United States in June 2025 and pleaded guilty to conspiracy and computer fraud in July 2026.
US authorities said Vardanyan participated in Ryuk attacks between March 2019 and June 2020 and extorted more than $1 million from several victims. The Justice Department’s description suggests he acted as a ransomware affiliate or initial-access provider, rather than developing Ryuk or operating the infrastructure behind the attacks. The article does not identify the affected victims or explain the specific access methods used.
Because time spent in pre-trial detention counts towards a federal sentence, Vardanyan has already served a substantial part of the 24-month term while in custody since his extradition.