Ryuk Ransomware Member Pleads Guilty in U.S. Attacks
Armenian national admits role in ransomware attacks targeting American companies between 2019-2020.
1Guilty Plea in Ryuk Ransomware Case
Armenian national Karen Serobovich Vardanyan pleaded guilty for his role in Ryuk ransomware attacks against U.S. organizations. Between 2019-2020, the group infected hundreds of servers, encrypting victims' data for ransom. Vardanyan now faces up to 15 years in prison.
2Financial Impact of Attacks
The Ryuk group collected approximately 1,610 Bitcoin (worth $15 million at the time), including 200 Bitcoin ($1.1M) from a Michigan company. Under his plea deal, Vardanyan agreed to pay over $1.1 million in restitution.
3Operational Techniques Revealed
Attackers gained initial network access to deploy Ryuk ransomware, creating unique ProtonMail addresses per victim to evade detection. Researchers uncovered money laundering through exchanges like Binance and Huobi.
4International Arrest and Extradition
Vardanyan was arrested in Ukraine in 2025 and extradited to the U.S. Indicted in February 2024 for conspiracy and computer fraud, his sentencing is scheduled for September 2026.
5Ryuk's Global Operations
Reports indicate Ryuk generated $150 million in ransom payments, targeting an Oregon tech company and Texas school among others. The group employed sophisticated money-moving techniques.
6Cybersecurity Lessons
This case underscores ransomware's severe consequences and the importance of international cooperation. Enhanced network security and cryptocurrency tracking systems will be crucial in preventing similar attacks.
Original article: Security Affairs — Ryuk Fidye Yazılımı Üyesi ABD'de Suçunu İtiraf Etti