Ryuk ransomware member gets two years in US prison

A member of the Ryuk ransomware gang has been sentenced by a US court to two years in prison, closing another chapter in one of the more damaging ransomware campaigns of recent years.

Karen Vardanyan, a 35-year-old Armenian national, was also given three years of supervised release and ordered to pay US$1.219 million ($1.7 million) in restitution to victims.

Vardanyan, also known as Manekeen and Karl Lagerfeld, was arrested in Kyiv and extradited to the US in 2025. He pleaded guilty in July 2026 to conspiracy and fraud in connection with computers.

US prosecutors said Vardanyan had been part of Ryuk since 2019 and helped deploy the ransomware around the world.

Ryuk became one of the better-known names in ransomware during a period when criminal crews were aggressively targeting organisations that could least afford downtime. According to the US Cybersecurity and Infrastructure Security Agency, Ryuk targeted American hospitals during the Covid-19 pandemic in 2020, alongside Conti ransomware activity.

The gang is said to have made at least US$15 million in extortion payments from victims.

The case also has an Australian footnote, though the local connection remains unclear.

The Australian Cyber Security Centre attributed a 2019 attack on Victoria’s healthcare sector to threat actors using Ryuk ransomware. Hospitals in the Gippsland Health Alliance and the South West Alliance of Rural Health were hit.

There is no evidence in the supplied material that Vardanyan was involved in those Australian attacks.

That distinction matters. Ransomware brands are often used by multiple actors, affiliates and crews, making attribution messy. A conviction tied to one operator does not automatically explain every attack linked to the same ransomware family.

US authorities have also alleged three other people — Levon Avetisyan, Oleg Lyulyava and Andrii Prikhodchenko — were members of the Ryuk ransomware gang.

The sentence lands as governments continue trying to claw back accountability for ransomware campaigns that crossed borders, hit critical services and extracted large payments from victims.

For Australian organisations, the practical takeaway is less about one sentence and more about the persistence of the model. Ryuk’s name may not dominate headlines the way it once did, but the playbook it helped popularise — network intrusion, encryption, extortion and pressure on essential services — remains firmly in use across the cybercrime economy.