Skip to content
Dark Web Intelligence on X: " RYUK RANSOMWARE MEMBER SENTENCED AFTER ...

Dark Web Intelligence on X: " RYUK RANSOMWARE MEMBER SENTENCED AFTER ...

X • September 23, 2026

Dark Web Intelligence on X: "🇺🇸🚨 RYUK RANSOMWARE MEMBER SENTENCED AFTER EXTRADITION FROM UKRAINE

The U.S. Department of Justice says Armenian national Karen Vardanyan has been sentenced for his role in the Ryuk ransomware operation targeting organizations in the United States and abroad.

• Vardanyan, 35, was sentenced to 24 months in federal prison plus three years of supervised release

• He was ordered to pay $1,219,106 in restitution

• DOJ says he used the monikers “Maneeken” and “Karl Lagerfeld”

• Prosecutors say he participated in the Ryuk conspiracy from March 2019 through approximately June 2020

• The operation deployed ransomware against companies, schools and other organizations worldwide

• Victims included an Oregon company; DOJ says the conspiracy extorted more than $1 million from several victims

• Vardanyan was extradited from Ukraine to the United States in 2025 and pleaded guilty in July 2026

• The FBI investigated the case, with Ukrainian authorities assisting the arrest and extradition

Ransomware prosecutions often arrive years after the underlying campaigns, but extradition changes the calculus for operators who assume geography permanently shields them from U.S. prosecution.

The case also provides another attribution point connecting a named individual and known aliases to the Ryuk ecosystem.

#Ryuk #Ransomware #DOJ #FBI #CyberCrime #ThreatIntel #DDW #DarkWeb"

🇺🇸🚨 RYUK RANSOMWARE MEMBER SENTENCED AFTER EXTRADITION FROM UKRAINE

The U.S. Department of Justice says Armenian national Karen Vardanyan has been sentenced for his role in the Ryuk ransomware operation targeting organizations in the United States and abroad.

• Vardanyan, 35, was sentenced to 24 months in federal prison plus three years of supervised release

• He was ordered to pay $1,219,106 in restitution

• DOJ says he used the monikers “Maneeken” and “Karl Lagerfeld”

• Prosecutors say he participated in the Ryuk conspiracy from March 2019 through approximately June 2020

• The operation deployed ransomware against companies, schools and other organizations worldwide

• Victims included an Oregon company; DOJ says the conspiracy extorted more than $1 million from several victims

• Vardanyan was extradited from Ukraine to the United States in 2025 and pleaded guilty in July 2026

• The FBI investigated the case, with Ukrainian authorities assisting the arrest and extradition

Ransomware prosecutions often arrive years after the underlying campaigns, but extradition changes the calculus for operators who assume geography permanently shields them from U.S. prosecution.

The case also provides another attribution point connecting a named individual and known aliases to the Ryuk ecosystem.

Armenian National Extradited to the United States Sentenced to Federal

🇺🇸🚨 RYUK RANSOMWARE MEMBER SENTENCED AFTER EXTRADITION FROM UKRAINE

The U.S. Department of Justice says Armenian national Karen Vardanyan has been sentenced for his role in the Ryuk ransomware operation targeting organizations in the United States and abroad.

• Vardanyan, 35, was sentenced to 24 months in federal prison plus three years of supervised release

• He was ordered to pay $1,219,106 in restitution

• DOJ says he used the monikers “Maneeken” and “Karl Lagerfeld”

• Prosecutors say he participated in the Ryuk conspiracy from March 2019 through approximately June 2020

• The operation deployed ransomware against companies, schools and other organizations worldwide

• Victims included an Oregon company; DOJ says the conspiracy extorted more than $1 million from several victims

• Vardanyan was extradited from Ukraine to the United States in 2025 and pleaded guilty in July 2026

• The FBI investigated the case, with Ukrainian authorities assisting the arrest and extradition

Ransomware prosecutions often arrive years after the underlying campaigns, but extradition changes the calculus for operators who assume geography permanently shields them from U.S. prosecution.

The case also provides another attribution point connecting a named individual and known aliases to the Ryuk ecosystem.

Armenian National Extradited to the United States Sentenced to Federal

Extracted Entities

Attack Types (1)

Countries (2)

Ransomware Groups (1)