On 22 September 2026 a federal judge in the District of Oregon sentenced Karen Vardanyan, an Armenian national extradited from Ukraine, to 24 months in prison and three years of supervised release for conspiracy and computer fraud in connection with the Ryuk ransomware operation. He was ordered to pay $1,219,106 in restitution. He had pleaded guilty on 8 July. The conspiracy, which ran from March 2019 to about June 2020, extorted more than $1 million from several victims including a company in Wilsonville, Oregon.
Vardanyan used the handles Maneeken and Karl Lagerfeld. Court documents describe three co-conspirators and more than 2,400 Ryuk attacks. A Michigan company paid about $1.2 million in January 2020, and the wider conspiracy collected about 1,160 bitcoin, roughly $15 million at the time. SecurityWeek characterised his role as likely an affiliate or initial-access provider rather than a core operator.
What The Sentence Measures
The superseding indictment was returned in February 2024, the extradition arrived in June 2025 and the sentence in September 2026, for conduct that ended six years earlier. Two years of prison against $15 million collected and 2,400 attacks is the arithmetic of prosecuting the reachable participant. The corpus filed at 26-0810 the argument that advisories are what is available when operators are out of reach; a sentencing is what is available when one of them travels.
Ryuk, In The Record
Ryuk was the operation that made hospital ransomware a national security question in the autumn of 2020, when a joint advisory warned of an imminent campaign against U.S. healthcare. Its successors, Conti and the operations that grew from Conti’s leak, account for a substantial share of the files in this database’s ransomware section. The person sentenced this month was, by the government’s own account, a participant in its earlier and smaller phase, and the operators who built what came after were not in the courtroom.
Compiled from the U.S. Attorney’s Office release and contemporaneous reporting, listed below. Dates follow the Justice Department where press accounts differ. The characterisation of the defendant’s role is SecurityWeek’s reading of the court record. The sentencing judge is not named in the material reviewed. Graded high. Corrections: corrections@forensicpost.com.
- Armenian National Extradited to the United States Sentenced to Federal Prison for Ransomware ExtortionU.S. Attorney’s Office, District of Oregon
- Ryuk ransomware operator gets 2-year sentence after extorting victims for $1.2 millionThe Record
- Ryuk ransomware operator sentenced to 2 years in prisonCyberScoop
- US Court Sentences Armenian Man to Prison for Ryuk Ransomware AttacksSecurityWeek