Ryuk: 24 Months for Core Affiliate Highlights Federal Sentencing Disparity

Karen Serobovich Vardanyan, 35, an Armenian national and core member of the Ryuk ransomware group, was sentenced on September 23, 2026, to 24 months in federal prison and ordered to pay $1,219,106 in restitution. The ruling, handed down by the U.S. District Court for the District of Oregon, marks a new chapter in the history of a criminal operation that struck more than 2,400 victims, including hospitals, schools, and public agencies. For an organization that collected over $15 million in extortion payments, the sentence appears both light and unusual in the landscape of U.S. ransomware convictions.

Ryuk's Structure and Vardanyan's Role

Ryuk was never a monolithic operation. The affiliate model that defined it required a specialized division of labor: some operators handled initial access, others developed and managed the malware, and still others conducted negotiations and laundering. Vardanyan fell into the first category. According to documents cited by the Department of Justice, "Vardanyan and his co-conspirators obtained unauthorized access to the computer networks of victim companies and deployed ransomware on hundreds of compromised servers and workstations."

A more specific quotation, drawn from court documents and reported by Bitdefender, narrows Vardanyan's direct activity window to "between November 2019 and April 2020," a five-month span in which he "obtained unauthorized access to the computer networks of victim companies to deploy Ryuk ransomware on compromised servers and workstations." The distinction between access and deployment matters: Vardanyan admitted to personally extorting over $1 million, but the final payload was managed by co-conspirators.

Identified co-conspirators in the court filings are Levon Georgiyovych Avetisyan, an Armenian national, and two Ukrainian nationals, both 53: Oleg Nikolayevich Lyulyava and Andrii Leonydovich Prykhodchenko. Their current judicial status is unknown; the dossier does not specify whether they have been extradited, prosecuted, or remain at large.

The Restitution Figure Versus the Real Damage

The court imposed $1,219,106 in restitution on Vardanyan. This amount represents what the operator personally extorted, not the group's total damage. For context: a single 2020 Ryuk attack on Universal Health Services (UHS), a U.S. hospital operator, caused estimated operational losses exceeding $67 million, as previously reported by BleepingComputer. The restitution ordered for Vardanyan covers less than 2% of that single damage line item.

The most documented payment in the Vardanyan case involves a Michigan company that transferred 200 bitcoin, valued at over $1.1 million at the time of the transaction. The Department of Justice explicitly cited this case in court documents: "Vardanyan worked with his co-conspirators to attack a company in Michigan that paid 200 bitcoin, or over $1.1 million at the time of payment, to restore access to its network."

"Between November 2019 and April 2020, Vardanyan obtained unauthorized access to the computer networks of victim companies to deploy Ryuk ransomware on compromised servers and workstations" — DOJ court documents, via Bitdefender

Sentencing Disparity and the Constraints of International Jurisdiction

The most striking datum in the sentence remains its length: 24 months. Across federal ransomware convictions in the United States, penalties for affiliates of structured groups such as Conti or REvil have ranged from four to 16 years. Vardanyan, a core member of an operation that generated over $15 million, received a sentence equivalent to roughly one year per $625,000 in confirmed damage.

The dossier does not clarify whether the 24 months reflect a plea agreement or a downward departure from federal guidelines. What does emerge is the procedural context: Vardanyan was arrested in Kyiv in April 2025 and extradited to the United States the following July. He acknowledged immigration consequences, including removal from U.S. territory upon completion of his sentence. This profile suggests cooperation, even if partial, with prosecutors, although the dossier does not explicitly confirm that circumstance.

Extradition from Ukraine introduces another layer of complexity. Extradition proceedings in cybercrime cases take months or years, and national governments must balance investigative cooperation with diplomatic relations. Vardanyan arrived in the United States in July 2025; the court held the first hearing on June 20, 2025, and the guilty plea was entered on July 8, 2026. The entire procedural chain, from arrest to sentencing, required approximately 17 months, a relatively rapid pace by international extradition standards.

Why It Matters

The Vardanyan case offers no technical operational recommendations: no CVE to patch, no configuration to change, no indicator of compromise to monitor emerges from the analysis. The dossier does not specify which initial-access methods Vardanyan employed — phishing, exposed RDP, credential stuffing, or other tactics remain unknown — nor does it document specific remedial measures adopted by victims.

The case's relevance lies instead in three structural elements. First: it confirms that Ryuk operated as a criminal enterprise with specialized roles, not as an anarchic collective. Second: it demonstrates that even identified and prosecuted operators can receive marginal sentences relative to the damage caused, with uncertain deterrent effects. Third: the $1.2 million restitution, while substantial for a single defendant, represents a fraction of the actual economic damage, raising questions about the justice system's ability to restore even a significant share of losses to victims.

The FBI conducted the investigation with support from the DOJ's Office of International Affairs and Ukrainian authorities. Transnational cooperation worked up to a point: extradition occurred, a sentence was handed down, but the length of the sentence and the scope of restitution leave open questions about what federal justice can realistically achieve when confronting cybercriminals operating from territories with overlapping jurisdictions and divergent interests.

The dossier does not specify whether additional cryptocurrency was seized beyond the restitution order, nor does it indicate the current status of the co-conspirators. For organizations that suffered Ryuk attacks, the sentence offers little material satisfaction: the $1.2 million in restitution will be distributed among multiple victims, and Vardanyan's period of activity covers only a portion of the group's overall campaign.

Sources

• https://therecord.media/ransomware-ryuk-sentenced-DOJ
• https://www.bleepingcomputer.com/news/security/ryuk-ransomware-member-sentenced-to-24-months-in-prison/
• https://www.bitdefender.com/en-us/blog/hotforsecurity/ryuk-ransomware-operator-guilty
• https://cybersecuritynews.com/ryuk-ransomware-operator-sentenced/
• https://www.cryptika.com/ryuk-ransomware-operator-sentenced-for-deploying-malware-and-extorting-victim-networks/
• https://cyberscoop.com/karen-vardanyan-armenian-ryuk-ransomware-guilty/
• https://www.bleepingcomputer.com/news/security/universal-health-services-lost-67-million-due-to-ryuk-ransomware-attack/
• https://www.bleepingcomputer.com/
• https://www.bleepingcomputer.com/tutorials/

Information has been verified against cited sources and is current as of publication.

Fonti