Loading story…
U.S. prosecutors announced two significant ransomware case outcomes: Armenian national Karen Serobovich Vardanyan pleaded guilty to conspiracy and computer fraud for helping compromise U.S. organizations and deploy Ryuk ransomware, while Florida resident Angelo Martino was sentenced to 70 months for assisting the BlackCat/ALPHV gang. Court records say Vardanyan provided initial access to victim networks between November 2019 and April 2020, with victims including a Michigan company, a technology firm in Wilsonville, Oregon, and a Texas school. Prosecutors linked Vardanyan and his co-conspirators to roughly 1,610 bitcoin in ransom payments, valued at about $15 million at the time.
Vardanyan was arrested in Kyiv in April 2025, extradited to the United States in 2025, and now faces up to 15 years in prison, fines of $250,000 per charge, and more than $1.1 million in restitution; sentencing is scheduled for September 2026. In the separate BlackCat/ALPHV case, Martino was convicted for abusing his position as a ransomware negotiator to share confidential victim negotiation information with attackers, and his co-conspirators Ryan Goldberg and Kevin Martin had already received four-year prison terms. The cases underscore continued U.S. efforts to disrupt both ransomware operators and the support networks that enable extortion campaigns.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
Court proceedings in the Ryuk case are set to continue with Vardanyan scheduled for sentencing in September 2026.
U.S. prosecutors announced that Karen Serobovich Vardanyan pleaded guilty to conspiracy and computer fraud charges for accessing victim networks and helping deploy Ryuk ransomware. He also agreed to pay more than $1.1 million in restitution and faces up to 15 years in prison.
Angelo Martino of Florida was sentenced to 70 months in prison for helping the BlackCat/ALPHV gang extort victims by abusing his role as a ransomware negotiator and sharing confidential client negotiation information.
In the related BlackCat/ALPHV insider misconduct case, Ryan Goldberg and Kevin Martin previously pleaded guilty and were each sentenced to four years in prison.
After his arrest, Vardanyan was extradited from Ukraine to the United States to face charges in the Ryuk ransomware case.
Karen Serobovich Vardanyan was arrested in Kyiv as part of the U.S. case against him for his alleged role in Ryuk ransomware intrusions.
A federal grand jury in Portland indicted Karen Serobovich Vardanyan on charges tied to hacking U.S. companies and deploying Ryuk ransomware.
Karen Serobovich Vardanyan admitted to helping provide initial access to multiple U.S. victim networks and assisting deployment of Ryuk ransomware. The activity occurred between November 2019 and about six months afterward, affecting organizations including a Michigan company, a Wilsonville, Oregon company, and a Texas school.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcescworld.com
Open sourcecyberscoop.com
Open sourcebleepingcomputer.com
Open sourcetherecord.media
Open sourcejustice.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Former DigitalMint ransomware negotiator Angelo John Martino III was sentenced to 70 months in federal prison for conspiring with **BlackCat/ALPHV** affiliates and abusing confidential client information to drive up ransomware payments from U.S. victims. Prosecutors said Martino used sensitive details from at least five victim organizations—including negotiating positions, insurance limits, financial status, and planned responses—to help attackers increase pressure and extract larger payments, effectively working both sides of the negotiations. Authorities said the scheme contributed to extortion demands tied to roughly **$75.3 million** in victim losses. Martino also admitted conspiring with former DigitalMint negotiator Kevin Tyler Martin and former Sygnia incident response manager Ryan Clifford Goldberg to deploy BlackCat ransomware against five additional U.S. companies, including a medical firm that paid nearly **$1.3 million** in Bitcoin. The case was investigated by the FBI Miami Field Office and the U.S. Secret Service as part of **Operation Riptide**, and authorities seized millions in assets linked to Martino, with reports citing between **$7 million and $10 million**. The sentencing highlights the insider risk facing ransomware victims that rely on outside negotiators and incident response firms during extortion events.
Jul 14, 2026
The United States sentenced **Yaroslav Vasinskyi** (`Rabotnik`), a Ukrainian affiliate of the **Sodinokibi/REvil** ransomware operation, to **13 years and 7 months** in prison for his role in more than **2,500 attacks** that collectively sought over **$700 million** in ransom payments. Prosecutors said the scheme encrypted victim networks, threatened to leak stolen data, and used cryptocurrency exchangers and mixing services to launder proceeds; the court also ordered more than **$16 million** in restitution. U.S. authorities said related forfeiture actions recovered assets including **39.89138522 Bitcoin** and **$6.1 million**, and credited cooperation with Polish authorities for Vasinskyi’s extradition and prosecution. In a separate but related enforcement action, **Deniss Zolotarjovs**, a Latvian national tied to the **Karakurt** extortion operation and linked by investigators to the broader **Conti** ecosystem, was sentenced to **102 months** in prison after U.S. prosecutors accused him of helping pressure victims with stolen data, reviving unresolved extortion cases, and laundering cryptocurrency. Authorities said the Russian-linked group targeted more than **54 companies worldwide**, including victims whose stolen records included sensitive medical information, and generated losses exceeding **$56 million** across 13 victims with roughly **$13 million** more paid by 41 additional companies. The cases underscore sustained cross-border law enforcement action against ransomware and data-extortion actors operating through Russia-linked criminal networks.
Jun 29, 2026
Two cybersecurity professionals, Ryan Goldberg and Kevin Martin, have pleaded guilty to conspiracy charges after using their positions as a ransomware negotiator and incident response manager to conduct ransomware attacks with the ALPHV/BlackCat group. The pair, along with an unnamed co-conspirator, leveraged their infosec expertise to compromise five organizations—including a medical device company, a pharmaceutical firm, a doctor's office, an engineering company, and a drone manufacturer—between May and December 2023. They agreed to pay ALPHV administrators 20% of any ransom collected in exchange for access to the ransomware platform. The only successful extortion resulted in a $1.2 million bitcoin payment from the medical device company, which was split among the perpetrators, with a portion sent to ALPHV. Patient photos stolen from the doctor's office were published on the gang’s leak site. Goldberg and Martin face up to 20 years in prison, with sentencing scheduled for March. Authorities highlighted the betrayal of trust, as both men used their cybersecurity training and privileged access to facilitate the very crimes they were supposed to prevent.
Jun 29, 2026