Ryuk ransomware initial-access broker sentenced to two years after $15 million extortion spree
Karen Vardanyan, a 35-year-old Armenian national, was sentenced to two years in US federal prison and three years of supervised release for his role in the Ryuk ransomware operation, after pleading guilty in July to conspiracy and computer fraud12. Prosecutors described him as a core member of the gang who specialised in breaking into corporate networks, which Ryuk affiliates then encrypted, between 2019 and 202012; he and his co-conspirators collected roughly 1,610 bitcoin, worth over $15 million at the time, from victims including a Michigan company, a Texas school, and an Oregon technology firm1. He was extradited from Kyiv in July 2025 following his arrest, and must personally pay $1,219,106 in restitution matching the ransom he extorted2.
Ryuk, run by the Wizard Spider group before it pivoted to Conti in 2020, hit roughly 20 victims a week at its peak and collected more than $150 million in total, with heavy targeting of the healthcare sector during the pandemic1.
Why it matters: Ryuk shut down years ago, but US prosecutors are still working through its network of initial-access brokers, a reminder that ransomware affiliates remain exposed to prosecution long after a gang disbands.