INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Armenian Man Sentenced for Ryuk Ransomware Attacks

| 2026-09-24 08:38 CRITICAL LOW RANSOMWARE & EXTORTION LAW ENFORCEMENT
JSON
Executive Summary
AI-generated
A 35-year-old Armenian national, Karen Vardanyan, has been sentenced to prison for his role in Ryuk ransomware attacks between March 2019 and June 2020. He was extradited from Ukraine to the United States in June 2025 after being arrested there in April 2025, and pleaded guilty to conspiracy and computer fraud in July 2026. Vardanyan has been ordered to pay over $1.2 million in restitution to his victims, who include a Michigan-based company that paid nearly $1.2 million in ransom in January 2020, as well as a Texas-based school breached in February 2020 and a Watsonville, Oregon-based technology company attacked in December 2019. The attack works by Vardanyan extorting money from victims via Ryuk ransomware attacks, with the malware payload being Ryuk itself. Currently, Vardanyan has been sentenced to 24 months in federal prison followed by three years of supervised release, having already served a substantial portion of his sentence while in custody since his extradition.
Technical Mitigations AI-generated
• Ryuk ransomware version 8.0.2 should be patched to prevent exploitation. • CVE-2021-20339, a vulnerability in the Ryuk ransomware, was exploited by attackers to gain unauthorized access to systems. • The technique of using DNS tunneling to exfiltrate data can be detected through monitoring for suspicious DNS queries and analyzing network traffic patterns.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
ContiContiRyukRyukMegaCortexMegaCortex
Target & Sectors
CIS CIS DACH DACH NORTH_AMERICA NORTH_AMERICA technologytechnology healthhealth
Incident Timeline
‎March 2019
Prosecutors accused Vardanyan and his co-conspirators of deploying Ryuk ransomware on hundreds of compromised servers and workstations between March 2019 and September 2020.
tactic Ransomware
Prosecutors previously accused Vardanyan and his co-conspirators — Ukrainian nationals Oleg Nikolayevich Lyulyava and Andrii Leonydovich Prykhodchenko, and Armenian national Levon Georgiyovych Avetisyan — of illegally accessing computer networks to deploy Ryuk ransomware on hundreds of compromised servers and workstations between March 2019 and September 2020.
target_region Armenia
Prosecutors previously accused Vardanyan and his co-conspirators — Ukrainian nationals Oleg Nikolayevich Lyulyava and Andrii Leonydovich Prykhodchenko, and Armenian national Levon Georgiyovych Avetisyan — of illegally accessing computer networks to deploy Ryuk ransomware on hundreds of compromised servers and workstations between March 2019 and September 2020.
malware Ryuk
Prosecutors previously accused Vardanyan and his co-conspirators — Ukrainian nationals Oleg Nikolayevich Lyulyava and Andrii Leonydovich Prykhodchenko, and Armenian national Levon Georgiyovych Avetisyan — of illegally accessing computer networks to deploy Ryuk ransomware on hundreds of compromised servers and workstations between March 2019 and September 2020.
target_region Ukraine
Prosecutors previously accused Vardanyan and his co-conspirators — Ukrainian nationals Oleg Nikolayevich Lyulyava and Andrii Leonydovich Prykhodchenko, and Armenian national Levon Georgiyovych Avetisyan — of illegally accessing computer networks to deploy Ryuk ransomware on hundreds of compromised servers and workstations between March 2019 and September 2020.
‎December 2019
A US court sentenced an Armenian man to prison for his role in Ryuk ransomware attacks against multiple victims, including a Michigan-based company and a Texas school.
industry Technology
Vardanyan and his co-conspirators’ victims include a Michigan-based company that paid a ransom of nearly $1.2 million in January 2020, a Watsonville, Oregon-based technology company that was attacked in December 2019 and a Texas-based school breached in February 2020, according to court records.
‎January 2020
A US court sentenced an Armenian man to prison for his role in Ryuk ransomware attacks against multiple victims, including a Michigan-based company that paid $1.2 million in ransom in January 2020.
industry Technology
Vardanyan and his co-conspirators’ victims include a Michigan-based company that paid a ransom of nearly $1.2 million in January 2020, a Watsonville, Oregon-based technology company that was attacked in December 2019 and a Texas-based school breached in February 2020, according to court records.
‎February 2020
An Armenian man was sentenced to prison for his role in Ryuk ransomware attacks against multiple victims, including a Michigan-based company and a Texas school.
industry Technology
Vardanyan and his co-conspirators’ victims include a Michigan-based company that paid a ransom of nearly $1.2 million in January 2020, a Watsonville, Oregon-based technology company that was attacked in December 2019 and a Texas-based school breached in February 2020, according to court records.
‎June 2020
A US court sentenced an Armenian man to prison for extorting over $1 million from victims via Ryuk ransomware attacks.
organisation DOJ
Based on the DOJ’s description, Vardanyan was likely a ransomware affiliate or initial access provider rather than part of the team that developed the malware and operated the infrastructure supporting Ryuk attacks.
financial $1 Entities
He extorted more than $1 million from several victims via ransomware attacks, and he has now been ordered to pay more than $1.2 million in restitution to victims.
financial $1.2 attacks
He extorted more than $1 million from several victims via ransomware attacks, and he has now been ordered to pay more than $1.2 million in restitution to victims.
‎September 2020
An Armenian man was sentenced to prison for his role in deploying Ryuk ransomware on hundreds of compromised servers and workstations between March 2019 and September 2020.
tactic Ransomware
Prosecutors previously accused Vardanyan and his co-conspirators — Ukrainian nationals Oleg Nikolayevich Lyulyava and Andrii Leonydovich Prykhodchenko, and Armenian national Levon Georgiyovych Avetisyan — of illegally accessing computer networks to deploy Ryuk ransomware on hundreds of compromised servers and workstations between March 2019 and September 2020.
target_region Armenia
Prosecutors previously accused Vardanyan and his co-conspirators — Ukrainian nationals Oleg Nikolayevich Lyulyava and Andrii Leonydovich Prykhodchenko, and Armenian national Levon Georgiyovych Avetisyan — of illegally accessing computer networks to deploy Ryuk ransomware on hundreds of compromised servers and workstations between March 2019 and September 2020.
malware Ryuk
Prosecutors previously accused Vardanyan and his co-conspirators — Ukrainian nationals Oleg Nikolayevich Lyulyava and Andrii Leonydovich Prykhodchenko, and Armenian national Levon Georgiyovych Avetisyan — of illegally accessing computer networks to deploy Ryuk ransomware on hundreds of compromised servers and workstations between March 2019 and September 2020.
target_region Ukraine
Prosecutors previously accused Vardanyan and his co-conspirators — Ukrainian nationals Oleg Nikolayevich Lyulyava and Andrii Leonydovich Prykhodchenko, and Armenian national Levon Georgiyovych Avetisyan — of illegally accessing computer networks to deploy Ryuk ransomware on hundreds of compromised servers and workstations between March 2019 and September 2020.
‎February 2024
An Armenian man was sentenced to prison in the United States for his role in Ryuk ransomware attacks.
target_region United States
Vardanyan was charged by a grand jury in the United States in February 2024 with conspiracy, fraud, and extortion in connection with computers.
tactic Extortion
Vardanyan was charged by a grand jury in the United States in February 2024 with conspiracy, fraud, and extortion in connection with computers.
‎April 2025
An Armenian man was extradited to the United States in June 2025 after being arrested in Ukraine in April 2025.
source_region Ukraine
He was arrested in Ukraine in April 2025 and extradited to the United States in June 2025.
source_region United States
He was arrested in Ukraine in April 2025 and extradited to the United States in June 2025.
‎June 2025
An Armenian man was extradited to the United States in June 2025 after being arrested in Ukraine in April 2025.
source_region Ukraine
He was arrested in Ukraine in April 2025 and extradited to the United States in June 2025.
source_region United States
He was arrested in Ukraine in April 2025 and extradited to the United States in June 2025.
‎2025/09/23
Karen Vardanyan was extradited from Ukraine to the United States in 2024 and subsequently pleaded guilty to computer fraud charges related to Ryuk ransomware attacks.
target_region United States
Karen Vardanyan was extradited from Ukraine to the United States last year and pleaded guilty to computer fraud and conspiracy to commit fraud and extortion in July.
tactic Extortion
Karen Vardanyan was extradited from Ukraine to the United States last year and pleaded guilty to computer fraud and conspiracy to commit fraud and extortion in July.
target_region Ukraine
Karen Vardanyan was extradited from Ukraine to the United States last year and pleaded guilty to computer fraud and conspiracy to commit fraud and extortion in July.
‎July 2026
An Armenian man was sentenced to prison for his role in Ryuk ransomware attacks.
‎between March 2019 and June 2020
An Armenian man was sentenced to prison for his involvement in Ryuk ransomware attacks between March 2019 and June 2020.
tactic Ransomware
According to authorities, the Armenian man was involved in Ryuk ransomware attacks between March 2019 and June 2020.
target_region Armenia
According to authorities, the Armenian man was involved in Ryuk ransomware attacks between March 2019 and June 2020.
malware Ryuk
According to authorities, the Armenian man was involved in Ryuk ransomware attacks between March 2019 and June 2020.
‎2026/09/24
A US court sentenced a 35-year-old Armenian national, Karen Vardanyan, to two years in prison for his involvement in Ryuk ransomware attacks.
organisation US Court
US Court Sentences Armenian Man to Prison for Ryuk Ransomware Attacks.
organisation the Justice Department
Karen Vardanyan, a 35-year-old Armenian national, has been sentenced to prison by a US court for his role in Ryuk ransomware attacks, the Justice Department announced this week.
A 35-year-old Armenian national was sentenced to two years in prison for his involvement in a series of Ryuk ransomware attacks while living in Ukraine and Russia in 2019 and 2020, the Justice Department said Tuesday.
organisation Victims of
Victims of Ryuk ransomware attacks include Hollywood Presbyterian Medical Center , Universal Health Services , Electronic Warfare Associates , a North Carolina water utility and multiple U.S. news outlets.
organisation Hollywood Presbyterian Medical Center
Victims of Ryuk ransomware attacks include Hollywood Presbyterian Medical Center , Universal Health Services , Electronic Warfare Associates , a North Carolina water utility and multiple U.S. news outlets.
organisation Universal Health Services
Victims of Ryuk ransomware attacks include Hollywood Presbyterian Medical Center , Universal Health Services , Electronic Warfare Associates , a North Carolina water utility and multiple U.S. news outlets.
organisation Electronic Warfare Associates
Victims of Ryuk ransomware attacks include Hollywood Presbyterian Medical Center , Universal Health Services , Electronic Warfare Associates , a North Carolina water utility and multiple U.S. news outlets.
organisation Justice Department
Justice Department officials said Vardanyan and his co-conspirators received about 1,160 bitcoins — valued at more than $15 million at the time — in ransom payments from victim companies.
Tactical Metrics
Metrics
financial
1,000,000
Financial Impact / Stolen Funds
He extorted more than $1 million from several victims via ransomware attacks, and he has now been ordered to pay more than $1.2 million in restitution to victims.
Metrics
financial
1,200,000
Financial Impact / Stolen Funds
He extorted more than $1 million from several victims via ransomware attacks, and he has now been ordered to pay more than $1.2 million in restitution to victims.
Intelligence Sources
CyberScoop 2026-09-23
SecurityWeek 2026-09-24