A key player in a wave of devastating Ryuk ransomware attacks has been brought to justice, with an Armenian national pleading guilty to computer fraud and conspiracy. Karen Serobovich Vardanyan’s guilty plea marks a significant development in the ongoing effort to hold accountable those responsible for unleashing chaos on businesses and organizations worldwide.
Between November 2019 and April 2020, Vardanyan and his co-conspirators deployed Ryuk ransomware against three U.S.-based organizations. The victims include a Michigan-based company that paid out nearly $1.2 million in ransom, a Watsonville, Oregon-based tech firm targeted in December 2019, and a Texas-based school breached in February 2020. This is just a small slice of the thousands of organizations affected by Ryuk ransomware during this period.
Ryuk ransomware works by infiltrating computer networks through exploited vulnerabilities or phishing attacks, then encrypting files and demanding payment in Bitcoin for decryption keys. In Vardanyan’s case, he and his co-conspirators received over 1,160 Bitcoins – valued at more than $15 million at the time – from victim companies.
The Justice Department has accused Vardanyan and his associates of participating in a large-scale cybercrime operation that targeted not only private sector organizations but also state and local municipalities, school districts, and critical infrastructure. The scale of the attacks is staggering, with Ryuk ransomware infecting thousands of victims across the globe between 2019 and 2020.
The impact on individual businesses and communities has been severe. For example, in 2019, Hollywood Presbyterian Medical Center paid out a reported $17 million to hackers after being hit by a Ryuk ransomware attack. Similarly, Universal Health Services was targeted in 2019, resulting in significant disruption to patient care.
Vardanyan’s guilty plea is a significant step towards accountability for those responsible for these devastating attacks. As part of his plea deal, he has agreed to pay nearly $1.2 million in restitution and faces up to 15 years in jail. The U.S. District Court for the District of Oregon will schedule his sentencing at a later date.
For businesses and individuals looking to protect themselves from similar threats, it’s essential to stay vigilant about cybersecurity best practices. This includes implementing robust security protocols, keeping software up-to-date, and educating employees on how to spot phishing scams. By being proactive in our approach to cybersecurity, we can reduce the risk of falling victim to these types of attacks and mitigate their impact when they do occur.
Source: CyberScoop — 2026-07-10