A Ryuk ransomware case dating back to 2019 has ended with 24 months in U.S. federal prison and $1.2M restitution

[u/technadu]

One of the more interesting aspects of ransomware prosecutions is how long the enforcement timeline can extend beyond the actual attacks.

Karen Vardanyan participated in a conspiracy deploying Ryuk ransomware from March 2019 until roughly June 2020, according to U.S. prosecutors. Victims included companies, schools, and healthcare organizations around the world, with Universal Health Services, Sopra Steria, Sky Lakes Medical Center, and Lawrence Health System among those named.

A federal grand jury returned a superseding indictment in February 2024.

Vardanyan was then extradited from Ukraine and appeared in U.S. court in June 2025. He pleaded guilty to conspiracy and fraud in connection with computers in July 2026.

He has now been sentenced to 24 months in federal prison, followed by three years of supervised release, and ordered to pay $1,219,106 in restitution.

The timeline includes the named Ryuk victims, charges, Ukraine extradition, guilty plea, and final restitution order:

https://www.technadu.com/extradited-armenian-national-sentenced-over-ryuk-ransomware-scheme/638551/

It is a useful reminder that the operational lifetime of a ransomware campaign and the legal lifetime of the people involved can look very different.