An Armenian national extradited from Ukraine has been sentenced to two years in federal prison for his role in Ryuk ransomware attacks that extorted more than $1.2 million from victims, the U.S. Attorney’s Office for the District of Oregon announced. Karen Vardanyan, who used the aliases Maneeken and Karl Lagerfeld, pleaded guilty in July 2026 to conspiracy and fraud in connection with computers. He was also ordered to pay $1.2 million in restitution and serve three years of supervised release. Prosecutors said Vardanyan took part in a conspiracy that deployed Ryuk ransomware against companies, schools, and other organizations from March 2019 to June 2020, with the broader scheme collecting roughly 1,160 bitcoins, worth more than $15 million at the time, from victims across the country.
For a SOC or incident response lead, this sentencing is a reminder that ransomware affiliates rarely face proportionate consequences relative to the damage caused, and that a two-year sentence for a six-figure extortion role is close to the going rate when the defendant is a mid-tier operator rather than a ransomware developer or negotiator. That gap matters for risk modeling: deterrence from prosecution alone is weak for the affiliates who do the actual deployment work, which is why detection and response capability still carries more of the defensive burden than the legal system does.
The original insight here is in the timeline, not the sentence. Vardanyan’s conspiracy ran from 2019 to 2020, and sentencing landed in 2026, six years later, after extradition from Ukraine. CyberTech has argued that reindicting nation-state hackers years after the fact does little to change attacker behavior, and the same lag applies here: the six-year gap between attack and consequence is long enough that it offers no deterrent signal to the ransomware affiliates operating today, including newer groups already weaponizing legitimate remote monitoring tools the way Ryuk affiliates once weaponized stolen credentials.
