Ryuk ransomware raider sentenced to two years prison

A US court has sentenced Karen Vardanyan, a member of the Ryuk ransomware gang, to two years in prison followed by three years’ of supervised release, and ordered US$1.219 million ($1.7 million) in restitution to victims.

The 35 year old Armenian national known as Manekeen and Karl Lagerfeld was arrested in Ukraine’s capital Kyiv and extradited to the US in 2025.

He pleaded guilty to conspiracy and fraud in connection with computers in July 2026, having been part of Ryuk since 2019, deploying the ransomware around the world, US prosecutors said.

The Australian Cybersecurity Centre (ACSC) attributed a 2019 attack on the Victorian healthcare sector to threat actors using the Ryuk ransomware.

Hospitals in the Gippsland Health Alliance, and the South West Alliance of Rural Health were hit by the ransomware.

It is not clear if Vardanyan was involved in the attacks on Australian healthcare providers.

Ryuk targeted American hospitals during the Covid-19 pandemic in 2020 along with the Conti ransomware, the US Cybersecurity and Infrastructure Security Agency (CISA) said.

Through their ransomware attacks, Ryuk is said to have reaped at least US$15 million in extortion money from victims.

Three other Ryuk members, Levon Avetisyan, Oleg Lyulyava and Andrii Prikhodchenko are alleged by the US to have been part of the ransomware gang.

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts