Ryuk operator gets 2 years for $1.2M in ransomware extortion
Vardanyan is the fifth Ryuk defendant sentenced in three years, but the two-year term barely registers against the gang's $15 million haul and 2,400-victim footprint, raising real questions about what individual-operator prosecution actually costs these networks.
TL;DR
Karen Vardanyan, 35, was sentenced to two years in federal prison and ordered to pay $1.2 million in restitution after pleading guilty to conspiracy and computer fraud. The Armenian national, extradited from Ukraine in 2025, was a core Ryuk operator who helped launch over 2,400 attacks on municipalities, hospitals, and schools, including during the COVID-19 pandemic. He's the fifth Ryuk defendant sentenced in three years. Total prison time across the gang's known leadership remains modest against at least $15 million in extracted ransoms.
Karen Vardanyan's two-year sentence lands as the fifth federal resolution against a Ryuk operator in three years, a pace that looks like progress on the scoreboard but raises uncomfortable questions about deterrence when you line up the numbers.
Vardanyan and his co-conspirators ran over 2,400 attacks. The gang pulled in at least $15 million. Universal Health Services alone took a $67 million hit from a Ryuk infection at the height of COVID-19, when the FBI was warning hospitals nationwide that Ryuk actors were actively targeting them. Against that backdrop, two years for an operator who personally extorted more than $1 million reads less as a warning shot than as the price of doing business.
The DOJ has been methodical here. In 2023, Russian money launderer Denis Dubnikov pleaded guilty in Oregon for washing Ryuk proceeds, he'd been arrested in the Netherlands and extradited. Armenian national Levon Avetisyan is in French custody awaiting extradition on conspiracy, fraud, and extortion charges. Two Ukrainians, Oleg Lyulyava and Andrii Prykhodchenko, have been charged but remain at large. Vardanyan's arrest in Kyiv and subsequent extradition in mid-2025 shows the international cooperation machinery is turning, slowly, but turning.
What's less clear is whether two-year sentences for individual operators meaningfully degrade the networks. Ryuk's infrastructure was tied to the same Russian group that ran Trickbot; its operators switched to Conti in 2020, then back to Ryuk. The organizational depth didn't vanish when one Armenian national got picked up in Kyiv.
For the municipal IT directors and hospital CISOs who lived through Ryuk's peak, the sentencing confirms what they already knew about the threat actor's identity and scale. That confirmation has operational value, it supports funding requests and incident-response planning. But the gap between $15 million in ransoms extracted and a $1.2 million restitution order from one defendant, most of which will likely never be collected, tells its own story about the economics of ransomware enforcement.
Published ·Deep Fathom