Ryuk ransomware operator ordered to pay $1.2M after US extradition
Hackers' cybercrime spree ends with a hefty bill.
Image by Cybernews.
Follow us
- Karen Vardanyan received 2 years in prison for his role in Ryuk ransomware attacks.
- A US court ordered him to pay $1.2 million in restitution to victims.
- Prosecutors said he targeted businesses, schools, and other organizations worldwide between 2019 and 2020.
- Ryuk generated about $150 million in ransom revenue before continuing under the Conti name.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
An Armenian national has been sentenced to 2 years in prison and has been ordered to pay $1.2 million in restitution for carrying out ransomware attacks.
According to court documents, 35-year-old Karen Vardanyan was a member of the ransomware operation called Ryuk.
The US Department of Justice alleges that Vardanyan, who used the monikers Maneeken and Karl Lagerfeld online, installed Ryuk ransomware on victims’ computer networks and extorted well over $1 million from several of his victims.
These payments were made in cryptocurrency, most of them in bitcoin.
The suspect participated in the ransomware extortion scheme between March 2019 and June 2020. During that period, he compromised networks from businesses, schools, and other organizations throughout the world.
In 2025, Vardanyan was extradited from Ukraine to the US. On July 8th, 2026, he pleaded guilty to conspiracy and fraud in connection with computers and extortion.
For his role in the Ryuk ransomware attacks, Vardanyan was sentenced to 2 years in federal prison and 3 years’ supervised release. He was also ordered to pay $1,219,106 in restitution to his victims.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
Ryuk was one of the most active and notorious ransomware operations of the late 2010s and early 2020s. The gang made its first appearance in 2018, but became particularly active in the following years.
Ryuk operated as a ransomware-as-a-service (RaaS) scheme, where ransomware developers lease their malicious software and infrastructure to other hackers or affiliates, who then use it to launch ransomware attacks for profit.
According to Trend Micro, Ryuk generated around $150 million in ransom revenue by the end of 2020, when the operation dissolved. However, the people and infrastructure behind the ransomware operation continued under the name Conti.
