Vardanyan pleads guilty in $1.2M Ryuk ransomware case

Vardanyan’s plea is a useful reminder that ransomware enforcement often arrives long after the network recovery work is over. CyberScoop, citing the Justice Department, reported that Karen Serobovich Vardanyan admitted participating in Ryuk ransomware activity from November 2019 to April 2020 while living in Ukraine and Russia. He pleaded guilty to computer fraud and conspiracy to commit fraud and extortion, agreed to pay nearly $1.2 million in restitution, and faces up to 15 years in prison.

The plea covers three U.S.-based organizations: a Michigan company that paid nearly $1.2 million in January 2020, a technology company attacked in December 2019, and a Texas school breached in February 2020. Prosecutors previously accused Vardanyan and three co-conspirators of deploying Ryuk across hundreds of compromised servers and workstations from March 2019 to September 2020. DOJ officials said the group received about 1,160 bitcoin, worth more than $15 million at the time.

For incident-response and compliance teams, the practical value is limited but real. The criminal case can fix attribution, impose restitution, and create a record of the campaign. It cannot give victims back the 2019 and 2020 response decisions. Sentencing in the District of Oregon has not been scheduled, and Vardanyan acknowledged that the conviction will lead to removal from the United States after he serves his sentence.