# Ryuk Ransomware Member Sentenced to Two Years in U.S. Prison Karen Vardanyan ordered to pay $1.2M for enabling Ryuk ransomware attacks. - **Source:** [Security Affairs](https://brifing.si/source/e6c4f5ec-3e1b-4152-a932-056243bd56eb) - **Published:** 2026-09-24 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/8b6ed679-01ce-4b53-b929-1e01013481f1 ## Ryuk member sentenced Karen Vardanyan, a 35-year-old Armenian national known online as 'Maneeken', received a 24-month federal prison sentence and three years of supervised release. Extradited from Ukraine, he was ordered to pay $1,219,106 in restitution to victims of Ryuk ransomware attacks he facilitated between 2019-2020. His role involved providing initial network access that enabled ransomware deployment. ## Attack methodology Vardanyan illegally accessed corporate networks from November 2019 to April 2020, helping deploy Ryuk ransomware on hundreds of servers and workstations. The malware encrypted victims' data, demanding Bitcoin payments for decryption keys. Among impacted organizations were a Michigan company that paid 200 Bitcoin ($1.1M then), an Oregon firm, and a Texas school. ## Ryuk's financial scale The Ryuk operation collected approximately 1,610 Bitcoin ($15M+ at payment time) across all attacks. A 2021 report estimated total earnings around $150 million from Bitcoin ransoms. Researchers traced 61 wallet addresses linked to the group, uncovering money laundering through brokers, intermediary wallets, and exchanges like Binance and Huobi. ## Operational tactics Ryuk operators used professional money-flow techniques and created unique ProtonMail addresses per victim to evade detection. At its peak, the group compromised about 20 organizations weekly. The FBI investigation revealed Vardanyan's role as the initial access provider - a critical but often overlooked component in ransomware attacks. ## Wizard Spider connection Ryuk was operated by Wizard Spider, which later rebranded as Conti ransomware in 2020. Conti grew even larger before its 2022 leak. The group eventually fragmented, with members joining other operations or forming new ones. This lineage remains visible in today's ransomware landscape, showing how groups evolve despite law enforcement actions. ## International cooperation Vardanyan's extradition from Ukraine marked significant international collaboration, with Ukrainian authorities receiving direct acknowledgment from the U.S. Department of Justice. This sets an important precedent given how ransomware operators frequently exploit non-cooperative jurisdictions to evade prosecution. ## Sentencing implications The 24-month sentence for enabling $15M in damages raises questions about proportionality in cybercrime cases. However, the successful extradition itself delivers a stronger message: national borders no longer guarantee safety for cybercriminals as international law enforcement coordination improves. ## Security takeaways The case underscores how initial network access providers enable devastating ransomware attacks, though they rarely execute the final payload. Organizations must monitor all access points, not just perimeter defenses. The prosecution also demonstrates growing effectiveness in tracing cryptocurrency flows across international boundaries. ## Sources covering this story - https://securityaffairs.com/199692/cyber-crime/ryuk-member-karen-vardanyan-sentenced-to-two-years-in-u-s-prison.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._