Ryuk ransomware suspect admits role in $15 million hacking spree

Key points

• Karen Serobovich Vardanyan, 34, pleaded guilty in a US federal court to helping run the Ryuk ransomware operation between November 2019 and April 2020.
• One Michigan victim paid 200 bitcoin, worth more than $1.1 million at the time, to get its files back.
• Prosecutors say Vardanyan and his co-conspirators collected about 1,610 bitcoin, roughly $15 million, in ransom payments.
• He faces up to 15 years in prison and is scheduled to be sentenced in September 2026.
• Vardanyan has agreed to pay more than $1.1 million in restitution as part of his plea deal.

An Armenian man has admitted to breaking into US company networks and deploying Ryuk, a strain of ransomware that scrambles a company's files until a payment is made.

Karen Serobovich Vardanyan, 34, was arrested in Kyiv in April 2025 and extradited to the United States. He pleaded guilty this week in a federal court in Portland, Oregon, as first reported by BleepingComputer.

His role, according to prosecutors, was the front door. He got into corporate networks illegally, then handed that access to partners who dropped the ransomware onto servers and staff computers.

How did the hackers actually get paid?

In cryptocurrency, and a lot of it. The US Department of Justice says Vardanyan and his co-conspirators received about 1,610 bitcoin in ransom payments, worth roughly $15 million at the time.

One case stands out. A company in Michigan paid 200 bitcoin, more than $1.1 million on the day, to get its systems unlocked. Two other named victims were a technology firm in Wilsonville and a school in Texas. Court documents say the group encrypted hundreds of servers and workstations across the victim companies.

Who was Ryuk?

Ryuk ran from 2018 until mid-2020 and hit almost every kind of organisation you can name, including hospitals during the early months of the COVID-19 pandemic. At its peak, researchers estimated the gang was breaking into around 20 organisations a week and had pulled in more than $150 million overall.

The group didn't really vanish. When Ryuk wound down in 2020, many of the same people moved to Conti, which became one of the most prolific extortion operations on the internet. Conti fell apart in 2022 after someone leaked its internal chat logs and source code. Our 3 July story "Ransomware Surge Led by Lockbit and Conti Offshoots" found those fragments are still generating attacks today.

What kind of break-ins were these?

Ryuk affiliates weren't fussy about entry points. During the period Vardanyan is charged with, the group leaned heavily on stolen or guessed passwords for remote-access tools, plus phishing emails that planted TrickBot or BazarLoader, first-stage malware, on an employee's PC. From there they moved sideways through the network until they controlled the systems that mattered.

Should you worry about a second factor?

Honestly, yes. A large share of these intrusions started with a single reused password on a remote-desktop or VPN account. Multi-factor authentication, meaning a second check such as a code from a phone or a hardware key, would've stopped many of them. It's not a silver bullet, but it's the closest thing the industry has.

This extradition is the sixth we've covered in the last 90 days, a pattern worth watching. Vardanyan's arrest in Kyiv and subsequent transfer to Portland shows that jurisdictions previously thought to offer sanctuary are proving less reliable for suspects than they once did.

What happens to Vardanyan now?

He was indicted by a federal grand jury in Portland in February 2024. Sentencing is set for September 2026, with a maximum of 15 years across two charges and fines of $250,000 on each. He's also agreed to pay back more than $1.1 million.

If your employer still lets staff log in to email or remote systems with just a password, push for a second factor. That single change would've kept a lot of Ryuk's victims out of these headlines.