Armenian National Sentenced to Two Years for Role in Ryuk Ransomware Campaigns

WASHINGTON — An Armenian national was sentenced Tuesday to 24 months in federal prison for his involvement in a sophisticated ransomware campaign that targeted U.S. companies and encrypted critical business systems.

Karen Serobovich Vardanyan appeared before a federal judge in the United States to accept the sentence, concluding a legal process stemming from cyberattacks attributed to the Ryuk ransomware group. The conviction marks a significant enforcement action against individuals linked to the malware strain known for crippling operations at hospitals, manufacturing plants, and other essential infrastructure across the nation.

Prosecutors detailed that Vardanyan played a central role in deploying the malicious code designed to lock victims out of their networks until a ransom was paid. The attacks, which occurred over several years, forced numerous American organizations to halt operations while they negotiated with cybercriminals or attempted to restore data from backups. The Ryuk group has been identified by cybersecurity experts as a major threat actor responsible for billions of dollars in damages globally.

The sentencing reflects the federal government's intensified efforts to hold individuals accountable for cybercrimes originating outside U.S. borders. While Vardanyan was based in Armenia, the charges focused on the impact of his actions within the United States. The court found that his activities directly contributed to the disruption of commerce and the compromise of sensitive data held by American entities.

During the proceedings, officials noted that the Ryuk attacks often involved a multi-stage intrusion, beginning with initial access through compromised credentials followed by lateral movement within corporate networks before the final encryption phase. Vardanyan's specific role involved coordinating these technical operations to maximize pressure on victims.

The two-year prison term is accompanied by additional penalties and restitution orders intended to compensate some of the affected organizations for their losses. However, the full financial impact of the campaign remains difficult to quantify as many companies do not disclose the total amounts paid or the extent of operational downtime.

Law enforcement officials stated that while Vardanyan's sentencing closes one chapter of the investigation, the broader network behind the Ryuk ransomware group remains active. Authorities continue to monitor global cyber threats and work with international partners to dismantle other cells involved in similar extortion schemes. Questions remain regarding the status of other alleged accomplices who have not yet been identified or apprehended.

As the case concludes, cybersecurity firms warn that the tactics used by Ryuk are evolving, with attackers increasingly targeting supply chains and third-party vendors to gain access to larger corporate networks. The conviction serves as a warning to potential offenders but also highlights the persistent challenge of securing digital infrastructure against determined adversaries.