Karen Vardanyan received 24 months in federal prison and was ordered to repay $1,219,106 to victims.

 

What happened

A federal court in Portland sentenced Karen Vardanyan, a 35-year-old Armenian citizen extradited from Ukraine, to 24 months in prison and three years of supervised release on September 22, 2026, the US Attorney's Office for the District of Oregon announced. He was also ordered to pay $1,219,106 in restitution. Court documents record that Vardanyan, who used the online names Maneeken and Karl Lagerfeld, belonged to a conspiracy that deployed Ryuk ransomware on victim networks and extorted more than $1 million. He took part between March 2019 and roughly June 2020, with targets including companies, schools, and other organizations. One of the victim companies was based in Wilsonville, Oregon.

 

Going deeper

Sentencing took place approximately six years after the attacks. A federal grand jury in Portland returned a superseding indictment on February 22, 2024, charging Vardanyan with conspiracy, fraud in connection with computers, and extortion in connection with computers. He first appeared in federal court on June 20, 2025, following extradition, and was detained. He pleaded guilty to conspiracy and computer fraud on July 8, 2026. The wider case remains open. Three co-defendants were charged alongside him, with one Armenian national the subject of a US extradition request in France and two Ukrainian nationals not in custody, Dark Reading reported when the charges were unsealed.

 

What was said

Vardanyan "was a member of a conspiracy that deployed Ryuk ransomware on victim computer networks to extort over $1 million from several victims," the US Attorney's Office stated in its sentencing announcement, which credited the FBI with investigating the case and the Justice Department's Office of International Affairs with securing the arrest and extradition. US Attorney Scott E. Bradford for the District of Oregon made the announcement, and Assistant US Attorney Katherine Rykken prosecuted.

 

In the know

The conspiracy's total take far exceeds the amount attributed to Vardanyan individually. Prosecutors alleged that he and his co-conspirators received approximately 1,610 bitcoins in ransom payments from victim companies, worth more than $15 million at the time they were paid. One Michigan company paid 200 bitcoin, then worth over $1.1 million, to restore access to its network, and a school in Texas was among the victims, Infosecurity Magazine reported at the plea stage. The restitution figure in the sentence reflects losses proven against this defendant rather than the conspiracy's total proceeds.

 

The big picture

Ryuk is the operation that prompted the first emergency warning to American hospitals. CISA, the FBI, and HHS issued a joint advisory in October 2020 describing credible information of an increased and imminent cybercrime threat to US hospitals and healthcare providers, specifically covering Ryuk and the TrickBot malware used to deliver it, in advisory AA20-302A. The attacks Vardanyan took part in ran through that same period. Healthcare organizations reading the sentencing should note what the timeline shows about where their protection comes from, since the intrusions occurred in 2019 and 2020, the indictment arrived in 2024, and the sentence in 2026. Prosecution reaches individual participants years afterwards and recovers a fraction of what was paid, which leaves prevention and tested recovery as the measures operating on any useful timescale.

 

FAQs

What was Ryuk and is it still active?

Ryuk was a ransomware strain used against large organizations from 2018 onwards, typically delivered through other malware already present on a network. Its operators have since moved to other names and tooling, which is common as groups rebrand to shed attention from law enforcement.

 

Why does prosecution take so long in these cases?

Attribution requires tracing cryptocurrency and infrastructure across jurisdictions, charges must be filed under seal while suspects remain abroad, and extradition depends on treaty arrangements and the cooperation of the host country. Each stage can take years.

 

What does restitution actually recover for victims?

Courts order restitution based on losses proven against the specific defendant, and collection depends on assets the defendant holds. Victims frequently receive a fraction of the ordered amount, and the process runs separately from any insurance claim.

 

Does an arrest disrupt the group's operations?

Rarely in a lasting way. Ransomware operations distribute roles across many people, and arresting one participant removes a contributor rather than the capability. Infrastructure seizures tend to produce more disruption than individual prosecutions.

 

What should a healthcare organization take from a case like this?

That law enforcement outcomes arrive on a scale of years and recover limited amounts, which places the practical weight on controls that prevent intrusion and on backups tested through full restoration. Neither depends on anyone being caught.