WASHINGTON, September 25 — The US Justice Department has announced that Karen Vardanyan, a 35-year-old Armenian national, has been sentenced to 24 months in federal prison followed by three years of supervised release for his role in Ryuk ransomware attacks. Vardanyan was also ordered to pay more than $1.2 million in restitution to victims. He had pleaded guilty to conspiracy and computer fraud in July 2026, and under federal law the time he has spent in pretrial detention counts toward the prison term.
Because he has been in custody since his extradition, he has already served a substantial portion of the 24 months.
The long road to a courtroom
A grand jury in the United States charged Vardanyan in February 2024 with conspiracy, fraud, and extortion in connection with computers. He was arrested in Ukraine in April 2025 and extradited to the United States in June 2025. The Justice Department’s announcement this week did not specify the court or the exact date of the sentencing hearing.
According to authorities, Vardanyan was involved in Ryuk ransomware attacks between March 2019 and June 2020, and extorted more than $1 million from several victims. The technical reality of that period is worth recalling.
Ryuk was a targeted, manually deployed strain — operators gained a foothold, moved laterally, and encrypted at scale — and the ecosystem around it depended on people who could get in the door. Based on the DOJ’s description, Vardanyan was likely a ransomware affiliate or initial access provider rather than part of the team that developed the malware and ran the infrastructure behind it. That distinction, as ever, is the detail that matters: it shapes the charges, and it shapes the sentence.
A busy year for ransomware prosecutions
The case sits inside a broader pattern of ransomware prosecutions this year. Most recently, a Ukrainian Conti ransomware developer received a four-year prison sentence in the United States, and a Ukrainian accused of creating the Lockergoga, MegaCortex, and Nefilim ransomware families has been sentenced to 13 years in prison by a Swiss court. Elsewhere on the cybercrime beat, the picture is no tidier.
A company notified the SEC that hackers accessed patient, employee, provider, business, and financial information. FulcrumSec said it stole over 80 GB of data from Manchester Airports Group and plans to leak it online.
The Rhysida ransomware group claimed the exfiltration of over 5TB of data, including personal information and credentials. The Bureau of Alcohol, Tobacco, Firearms and Explosives described an incident as a “major incident” and is conducting an investigation with the DOJ. A cybercrime gang listed major companies including Shell, Philips, Fiserv, Zebra, Mindray, and Largan Precision.
Maksim Silnikau was identified as the creator and administrator of a ransomware group and as involved in Angler EK’s distribution. And an extortion group stole personal, financial, and medical information from a hospital’s network.
Under the hood, the through-line is the same one Vardanyan’s case illustrates. The ransomware economy is not a monolith of masterminds; it is a supply chain, and prosecutors are working it from both ends — developers and the affiliates and access providers who feed them victims. The DOJ’s description of Vardanyan’s role suggests he was not a core Ryuk developer, and that distinction may well have influenced both the charges and the sentence he received.
What to watch next is whether the affiliate tier keeps producing extraditions and guilty pleas at this pace, and whether the restitution orders that accompany them translate into anything victims can actually collect. The Justice Department has made the international effort to prosecute the ransomware ecosystem a running theme this year. Vardanyan’s 24 months, credited heavily for time served, is the latest entry in that ledger.
