Loading story…
Armenian national Karen Serobovich Vardanyan, also known as “Maneeken” and “Karl Lagerfeld,” was sentenced to 24 months in U.S. federal prison for his role in the Ryuk ransomware conspiracy. Extradited from Ukraine in 2025, Vardanyan pleaded guilty in July 2026 to conspiracy and computer fraud; his sentence also includes three years of supervised release and $1,219,106 in victim restitution.
Vardanyan obtained initial access to corporate networks used in Ryuk attacks against organizations worldwide from March 2019 through about June 2020, including victims in Michigan, Texas, and Oregon. The group encrypted victim systems and demanded Bitcoin payments for restoration, receiving roughly 1,610 BTC—valued at more than $15 million at the time—from hundreds of compromised systems; the FBI, Ukrainian authorities, and the U.S. Justice Department supported the investigation and prosecution.
TTPs, infrastructure, and targeting history in one profile.
8 events from the most recent confirmed update back to the earliest known activity.
Vardanyan pleaded guilty to conspiracy and computer fraud for his role in the Ryuk ransomware conspiracy.
Ukraine extradited Vardanyan to the United States, where he made his initial appearance in federal court and was ordered detained by a magistrate judge.
Ukrainian authorities arrested Armenian national Karen Vardanyan in Kyiv in connection with his alleged role in Ryuk ransomware attacks.
A federal grand jury in Portland returned a superseding indictment charging Vardanyan with conspiracy, computer fraud, and computer extortion related to the Ryuk ransomware scheme.
The Ryuk operation shut down in 2020, after which Wizard Spider shifted to operating the Conti ransomware operation.
Karen Serobovich Vardanyan and co-conspirators conducted Ryuk ransomware attacks from March 2019 through approximately June 2020, gaining unauthorized access and deploying ransomware on hundreds of systems. Victims included a Michigan company, a Texas school, and a technology company in Wilsonville, Oregon; the conspirators received roughly 1,610 BTC, valued at more than $15 million when paid.
The Wizard Spider cybercrime gang operated Ryuk as a ransomware-as-a-service operation beginning in August 2018. The operation later became associated with attacks on healthcare organizations during the COVID-19 pandemic.
A U.S. court sentenced Vardanyan to 24 months in federal prison and three years of supervised release for his Ryuk ransomware role. The court also ordered him to pay $1,219,106 in restitution to victims.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
databreaches.net
Open sourcetherecord.media
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. prosecutors announced two significant ransomware case outcomes: Armenian national **Karen Serobovich Vardanyan** pleaded guilty to conspiracy and computer fraud for helping compromise U.S. organizations and deploy **Ryuk** ransomware, while Florida resident **Angelo Martino** was sentenced to **70 months** for assisting the **BlackCat/ALPHV** gang. Court records say Vardanyan provided initial access to victim networks between November 2019 and April 2020, with victims including a Michigan company, a technology firm in Wilsonville, Oregon, and a Texas school. Prosecutors linked Vardanyan and his co-conspirators to roughly **1,610 bitcoin** in ransom payments, valued at about **$15 million** at the time. Vardanyan was arrested in Kyiv in April 2025, extradited to the United States in 2025, and now faces up to **15 years in prison**, fines of **$250,000 per charge**, and more than **$1.1 million** in restitution; sentencing is scheduled for September 2026. In the separate BlackCat/ALPHV case, Martino was convicted for abusing his position as a ransomware negotiator to share confidential victim negotiation information with attackers, and his co-conspirators **Ryan Goldberg** and **Kevin Martin** had already received four-year prison terms. The cases underscore continued U.S. efforts to disrupt both ransomware operators and the support networks that enable extortion campaigns.
Jul 12, 2026
A U.S. federal court sentenced Russian national **Aleksei Volkov**, 26, to **81 months in prison** for acting as an initial access broker who helped major cybercrime groups, including the **Yanluowang** ransomware operation, compromise U.S. companies and other organizations. Prosecutors said Volkov gained unauthorized access to victim networks and sold that access to ransomware operators, who then deployed malware, encrypted systems, stole data, and extorted victims through cryptocurrency ransom demands. The U.S. Department of Justice said the campaign caused more than **$9 million in actual losses** and more than **$24 million in intended losses**. Volkov was indicted in Indiana and Pennsylvania, arrested in Rome, extradited from Italy to the United States, and later pleaded guilty after the cases were consolidated. As part of the plea, he admitted hacking victim networks, stealing data, helping co-conspirators deploy ransomware, and sharing in ransom proceeds; he was also ordered to pay at least **$9,167,198.19** in restitution and forfeit equipment used in the crimes.
Jun 29, 2026
The United States sentenced **Yaroslav Vasinskyi** (`Rabotnik`), a Ukrainian affiliate of the **Sodinokibi/REvil** ransomware operation, to **13 years and 7 months** in prison for his role in more than **2,500 attacks** that collectively sought over **$700 million** in ransom payments. Prosecutors said the scheme encrypted victim networks, threatened to leak stolen data, and used cryptocurrency exchangers and mixing services to launder proceeds; the court also ordered more than **$16 million** in restitution. U.S. authorities said related forfeiture actions recovered assets including **39.89138522 Bitcoin** and **$6.1 million**, and credited cooperation with Polish authorities for Vasinskyi’s extradition and prosecution. In a separate but related enforcement action, **Deniss Zolotarjovs**, a Latvian national tied to the **Karakurt** extortion operation and linked by investigators to the broader **Conti** ecosystem, was sentenced to **102 months** in prison after U.S. prosecutors accused him of helping pressure victims with stolen data, reviving unresolved extortion cases, and laundering cryptocurrency. Authorities said the Russian-linked group targeted more than **54 companies worldwide**, including victims whose stolen records included sensitive medical information, and generated losses exceeding **$56 million** across 13 victims with roughly **$13 million** more paid by 41 additional companies. The cases underscore sustained cross-border law enforcement action against ransomware and data-extortion actors operating through Russia-linked criminal networks.
Jun 29, 2026