Ryuk Ransomware Member Sentenced to Two Years in U.S. Prison
Karen Vardanyan ordered to pay $1.2M for enabling Ryuk ransomware attacks.
1Ryuk member sentenced
Karen Vardanyan, a 35-year-old Armenian national known online as 'Maneeken', received a 24-month federal prison sentence and three years of supervised release. Extradited from Ukraine, he was ordered to pay $1,219,106 in restitution to victims of Ryuk ransomware attacks he facilitated between 2019-2020. His role involved providing initial network access that enabled ransomware deployment.
2Attack methodology
Vardanyan illegally accessed corporate networks from November 2019 to April 2020, helping deploy Ryuk ransomware on hundreds of servers and workstations. The malware encrypted victims' data, demanding Bitcoin payments for decryption keys. Among impacted organizations were a Michigan company that paid 200 Bitcoin ($1.1M then), an Oregon firm, and a Texas school.
3Ryuk's financial scale
The Ryuk operation collected approximately 1,610 Bitcoin ($15M+ at payment time) across all attacks. A 2021 report estimated total earnings around $150 million from Bitcoin ransoms. Researchers traced 61 wallet addresses linked to the group, uncovering money laundering through brokers, intermediary wallets, and exchanges like Binance and Huobi.
4Operational tactics
Ryuk operators used professional money-flow techniques and created unique ProtonMail addresses per victim to evade detection. At its peak, the group compromised about 20 organizations weekly. The FBI investigation revealed Vardanyan's role as the initial access provider - a critical but often overlooked component in ransomware attacks.
5Wizard Spider connection
Ryuk was operated by Wizard Spider, which later rebranded as Conti ransomware in 2020. Conti grew even larger before its 2022 leak. The group eventually fragmented, with members joining other operations or forming new ones. This lineage remains visible in today's ransomware landscape, showing how groups evolve despite law enforcement actions.
6International cooperation
Vardanyan's extradition from Ukraine marked significant international collaboration, with Ukrainian authorities receiving direct acknowledgment from the U.S. Department of Justice. This sets an important precedent given how ransomware operators frequently exploit non-cooperative jurisdictions to evade prosecution.
7Sentencing implications
The 24-month sentence for enabling $15M in damages raises questions about proportionality in cybercrime cases. However, the successful extradition itself delivers a stronger message: national borders no longer guarantee safety for cybercriminals as international law enforcement coordination improves.
8Security takeaways
The case underscores how initial network access providers enable devastating ransomware attacks, though they rarely execute the final payload. Organizations must monitor all access points, not just perimeter defenses. The prosecution also demonstrates growing effectiveness in tracing cryptocurrency flows across international boundaries.
Original article: Security Affairs — Ryuk Ransomware Member Sentenced to Two Years in U.S. Prison