After years on the run, alleged Ryuk ransomware operator pleads guilty

A suspected member of the Ryuk ransomware operation pleaded guilty in a US federal court after being extradited from Ukraine, the US Department of Justice announced. Karen Serobovich Vardanyan, a 34-year-old Armenian national, admitted to participating in a conspiracy that targeted companies across the United States between late 2019 and early 2020. The attacks allegedly led to more than $15 million in ransom payments from victims. Vardanyan pleaded guilty to conspiracy and computer fraud for helping compromise corporate networks that were later encrypted with Ryuk ransomware. Investigators say he and his co-conspirators obtained unauthorized access to victim organizations before deploying ransomware and demanding payment in exchange for restoring access to critical systems. The attacks took place between November 2019 and April 2020 while Ryuk was among the world's most active ransomware operations. US authorities said Vardanyan was arrested in Kyiv in 2025, extradited to the United States, and entered his guilty plea in federal court in Portland, Oregon. Sentencing is scheduled for later this year, where he faces a maximum prison sentence of 15 years. He has also agreed to pay nearly $1.2 million in restitution to victims.