RansomwareJul 10, 2026

Armenian national pleads guilty to Ryuk ransomware attacks

Armenian national pleads guilty to Ryuk ransomware attacks, faces 15 years and $1.2M restitution.

An Armenian national, Karen Vardanyan, has pleaded guilty in the U.S. to participating in Ryuk ransomware attacks between 2019 and 2020. He admitted to deploying the ransomware against three U.S. organizations, agreeing to pay nearly $1.2 million in restitution and facing up to 15 years in prison. The Justice Department noted that Ryuk ransomware was widespread during that period, impacting various sectors globally.

AI summary of the linked source. Not reviewed by an editor. How this works

Read at source

Vendor Watch

Run Justice Department?

Get an email when a new story names Justice Department, usually within the hour.

Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch works Privacy

The lesson from this incident

Full lesson

Karen Vardanyan's guilty plea highlights the real-world consequences of ransomware attacks that exploited organizations lacking mature defenses against sophisticated threat actors. Ryuk ransomware was particularly destructive between 2019 and 2020, often targeting entities with weak endpoint protections, insufficient backups, and poor incident response readiness. The near $1.2 million restitution figure represents only a fraction of the total operational damage inflicted on victims. This case underscores that ransomware groups operate as organized criminal enterprises, making a proactive, layered security posture essential rather than optional.

What helps against this

How we list vendors

Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
For exampleBitdefender GravityZone Microsoft Defender for Endpoint Elastic Security all options
Immutable backup and recovery
Ransomware cannot delete or encrypt your way back.
For exampleCommvault Cloud Cohesity DataProtect Rubrik Zero Trust Data Protection all options
Incident response retainer
Experts are on call before the worst day, not searched for during it.
For exampleGoogle Mandiant Incident Response Truesec Incident Response Palo Alto Networks Unit 42 Retainer all options

Indicators of Compromise

Extracted by AI from the linked source. Not reviewed by an editor. How this works

malware — Ryuk
malware — Bitcoin

Entities

Karen Vardanyan (threat_actor)Justice Department (vendor)Oleg Nikolayevich Lyulyava (threat_actor)Andrii Leonydovich Prykhodchenko (threat_actor)Levon Georgiyovych Avetisyan (threat_actor)