Karen Vardanyan's 24-month Ryuk sentence is mostly time he has already served
Karen Vardanyan was arrested in Kyiv in April 2025, extradited within two months, and sentenced this week to 24 months that run against custody already served. Prosecutors had argued that only meaningful sentences change a cybercriminal's math.
The Watch · Security desk
What happened
- Karen Vardanyan, a 35-year-old Armenian national, was sentenced to 24 months in US federal prison and three years of supervised release for his part in Ryuk ransomware attacks.
- He pleaded guilty in July 2026 to conspiracy and computer fraud, following an April 2025 arrest in Kyiv and extradition to the United States that summer.
- Federal law credits pretrial detention toward the term, and Vardanyan has been held since his extradition, so a substantial portion of the 24 months is already served.
- He was ordered to pay $1,219,106 in restitution to victims after personally extorting more than $1 million in attacks dated from March 2019 to June 2020.
- The Justice Department said Vardanyan and his co-conspirators took about 1,160 bitcoins in ransoms, worth more than $15 million at the time of payment.
Why it matters
- What it sets up precedent Ukraine produced a Ryuk access broker for a US courtroom about two months after arresting him. The three named co-conspirators now face the same route.
- Who has to decide decision Anyone who wants prosecution risk in a ransomware threat model has to price it at 24 months for an access role, with pretrial credit and deportation attached, against a payoff measured in seven figures.
- What it costs cost Restitution covers about 8 percent of what the DOJ says the crew collected, and it is ordered against one man's assets, so victim recovery stays a function of who happens to be caught.
Next story · Security · Oct 7
MonsterCloud's owner is charged with passing off purchased ransomware keys as proprietary decryptionConfirmed10 publishers
Thirteen months of the term were served before the guilty plea. SecurityWeek dates the extradition to June 2025 [28]; The Record says July 2025 [29]. Vardanyan pleaded guilty on July 8 [5], 2026 [4]. Taking the earlier date, that is 13 months in custody before he entered the plea [25], leaving at most 11 months of the 24 [26], and the sentencing hearing came later still. His conviction will have immigration consequences resulting in removal from the United States after he serves the sentence [22].
The government made the deterrence argument itself. "Like Vardanyan, many cybercriminals are not masterminds of a complex ransomware or extortion scheme but nonetheless play an integral part in the success of these crimes," read a memo signed by U.S. attorneys in the District of Oregon [17]. "Unfortunately, high rewards and a relatively low risk of detection are basic features of cybercrime. The only way to affect the cost-benefit analysis of these crimes is to impose meaningful sentences on those who are caught," the attorneys added [18]. The sentence matches the terms of the plea agreement he reached with prosecutors, CyberScoop reported [16]. Prosecutors also said they found no evidence he was still engaged in criminal activity at the time of his arrest [21].
Rank sets the tier. The record on his rank is split. The Record reported that prosecutors called him a core member of the Ryuk gang and cited court documents describing more than 2,400 attacks worldwide [32]. BleepingComputer says he specialized in gaining initial access to corporate networks and used the handles "Maneeken" and "Karl Lagerfeld" [7]. SecurityWeek describes him as likely an affiliate or initial access provider on the basis of the DOJ's account, with malware development and infrastructure sitting with others [8]. A Ukrainian Conti developer drew four years in a US court this year [23], and a Swiss court gave 13 years to a Ukrainian accused of creating LockerGoga, MegaCortex and Nefilim [24].
Extradition worked fast: arrest in Kyiv in April 2025 [3], transfer to the United States roughly two months later [34], on charges a grand jury returned in February 2024 [15]. Three co-conspirators are named: Ukrainians Oleg Nikolayevich Lyulyava and Andrii Leonydovich Prykhodchenko, both 53, and Armenian national Levon Georgiyovych Avetisyan [12]. The Record reports several members of the group have been identified and arrested over the past three years [19], and a Russian man pleaded guilty in an Oregon federal court in 2023 to laundering Ryuk funds [20]. The sources do not say how many requests were made or refused.
Most of the money is gone. CyberScoop puts the DOJ figure for the crew's ransom receipts at about 1,160 bitcoins, worth more than $15 million at the time of payment [30]; BleepingComputer quotes the DOJ at approximately 1,610 bitcoins against the same $15 million valuation [31], a gap of 450 coins between the two accounts [33]. Restitution here is $1,219,106 [6], about 8 percent of $15 million [27]. One Michigan victim paid 200 BTC, worth over $1.1 million at the time [9]. Universal Health Services, hit in the same era, ultimately spent $67 million on its Ryuk attack [13], and at its peak the operation was hitting around 20 victims a week and collecting more than $150 million [14].
What to watch
- Whether Lyulyava, Prykhodchenko or Avetisyan reach a US court, and what terms they draw against Vardanyan's 24 months.
- Vardanyan's actual release and removal date, which will show how many months of the term were left after credit.
- Whether any part of the $1,219,106 restitution order is collected, and from what assets.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+10
- Incentives40
- Confidence66
Perspective Coverage
5 publishers- Builder
- Builder 9%
- Operator
- Operator 80%
- Investor
- Investor 11%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Karen Vardanyan, a 35-year-old Armenian national, was sentenced to 24 months in US federal prison followed by 3 years of supervised release for his role in Ryuk ransomware attacks.
- [2]
Authorities say Vardanyan was involved in Ryuk ransomware attacks between March 2019 and June 2020.
- [3]
Vardanyan was arrested in Kyiv, Ukraine, in April 2025.
- [4]
Vardanyan pleaded guilty to conspiracy and computer fraud in July 2026.
- [5]
Vardanyan pleaded guilty on July 8 to conspiracy and fraud in connection with computers.
- [6]
Vardanyan was ordered to pay $1,219,106 in restitution to victims.
- [7]
Vardanyan, also known online as "Maneeken" or "Karl Lagerfeld", specialized in gaining initial access to corporate networks.
- [8]
Based on the DOJ's description, Vardanyan was likely a ransomware affiliate or initial access provider rather than part of the team that developed the malware and operated the supporting infrastructure.
- [9]
In one attack, Vardanyan and his accomplices breached a Michigan company that paid 200 BTC, worth over $1.1 million at the time.
- [10]
Under federal law, time spent in pretrial detention is credited toward the prison term; Vardanyan has been in custody since his extradition, so he has already served a substantial portion of the 24-month sentence.
- [11]
Vardanyan extorted more than $1 million from several victims via ransomware attacks.
- [12]
Co-conspirators named by prosecutors are Ukrainian nationals Oleg Nikolayevich Lyulyava and Andrii Leonydovich Prykhodchenko, both 53, and Armenian national Levon Georgiyovych Avetisyan.
- [13]
Hospital chain Universal Health Services was hit with a Ryuk attack that ultimately cost the company $67 million.
- [14]
At its peak the Ryuk group hacked around 20 victims every week, collecting more than $150 million in ransoms; the RaaS operation was active between August 2018 and mid-2020.
- [15]
Vardanyan was charged by a US grand jury in February 2024 with conspiracy, fraud, and extortion in connection with computers.
- [16]
Vardanyan's sentencing matches the terms of the plea agreement he reached with prosecutors, according to CyberScoop.
- [17]
"Like Vardanyan, many cybercriminals are not masterminds of a complex ransomware or extortion scheme but nonetheless play an integral part in the success of these crimes," read a memo signed by U.S. attorneys in the District of Oregon.
- [18]
"Unfortunately, high rewards and a relatively low risk of detection are basic features of cybercrime. The only way to affect the cost-benefit analysis of these crimes is to impose meaningful sentences on those who are caught," the U.S. attorneys added.
- [19]
Several other members of the Ryuk group have been identified and arrested over the last three years.
- [20]
A Russian man pleaded guilty in 2023 in an Oregon federal court to laundering funds for Ryuk over three years, after being accused of acting as a middleman for the group.
- [21]
Prosecutors said they found no evidence Vardanyan was still engaged in criminal activity at the time of his arrest.
- [22]
Vardanyan's conviction will have immigration consequences resulting in removal from the United States after he serves his sentence.
- [23]
A Ukrainian Conti ransomware developer received a 4-year prison sentence in the United States this year.
- [24]
A Ukrainian accused of creating the LockerGoga, MegaCortex and Nefilim ransomware families was sentenced to 13 years in prison by a Swiss court.
- [25]
Between the June 2025 extradition and the July 2026 guilty plea, Vardanyan spent about 13 months in US custody.
- [26]
At the time of the guilty plea, at most 11 months of the 24-month term remained to be served.
- [27]
The $1,219,106 restitution order is about 8 percent of the $15 million the DOJ says the crew received.
- [28]
SecurityWeek reports Vardanyan was extradited to the United States in June 2025.
- [29]
The Record reports Vardanyan was extradited from Ukraine in July 2025 after being arrested in Kyiv.
- [30]
Justice Department officials said Vardanyan and his co-conspirators received about 1,160 bitcoins, valued at more than $15 million at the time, in ransom payments from victim companies.
- [31]
The DOJ said in July that Vardanyan and his co-conspirators are alleged to have received approximately 1,610 bitcoins in ransom payments, valued at over $15 million at the time of payment.
- [32]
Prosecutors accused Vardanyan of being a core member of the Ryuk ransomware gang, noting in court documents that he and his co-conspirators launched over 2,400 ransomware attacks on victims around the world.
- [33]
The two published bitcoin totals for the crew's ransom receipts differ by 450 coins.
- [34]
About two months passed between the April 2025 arrest in Kyiv and the June 2025 extradition.
Sources
5 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comRyuk ransomware member sentenced to 24 months in prison
1 article · September 23, 2026
- cyberscoop.comRyuk ransomware operator sentenced to 2 years in prison
1 article · September 23, 2026
- securityaffairs.comRyuk Member Karen Vardanyan Sentenced to Two Years in U.S. Prison
1 article · September 24, 2026
- securityweek.comUS Court Sentences Armenian Man to Prison for Ryuk Ransomware Attacks
1 article · September 24, 2026
- therecord.mediaRyuk ransomware operator gets 2-year sentence after extorting victims for $1.2 million
1 article · September 23, 2026
Topics and entities
Entities
- Levon Georgiyovych Avetisyan
- Conti
- Universal Health Services
- U.S. Department of Justice