Armenian Hacker Sentenced for Role in Ryuk Ransomware Attacks on U.S. Companies
A 35-year-old Armenian national, Karen Serobovich Vardanyan also known by the aliases "Maneeken" and "Karl Lagerfeld" has been sentenced to 24 months in prison and three years of supervised release for his involvement in a series of Ryuk ransomware attacks targeting U.S. organizations. Vardanyan, who specialized in gaining initial access to corporate networks, pleaded guilty in July 2025 after being extradited from Kyiv, Ukraine, where he was arrested in April.
Between March 2019 and June 2020, Vardanyan and his accomplices breached multiple U.S. companies, deploying Ryuk ransomware across hundreds of compromised servers and workstations. Among the victims were a Michigan-based company that paid 200 BTC (over $1.1 million at the time), a Texas school, and a technology firm in Wilsonville, Oregon. Prosecutors revealed that the group received approximately 1,610 bitcoins in ransom payments, valued at over $15 million at the time of the transactions.
Ryuk, a ransomware-as-a-service (RaaS) operation active from August 2018 to mid-2020, gained notoriety for its high-profile attacks, particularly during the COVID-19 pandemic when it targeted healthcare organizations. At its peak, the group compromised around 20 victims weekly and extorted over $150 million in ransoms. The cybercrime syndicate behind Ryuk, Wizard Spider, later shifted to the Conti ransomware strain, which became one of the most prolific hacking operations before disbanding in 2022 following a major data leak. The group’s remnants splintered into smaller factions, some of which joined existing ransomware gangs or launched new campaigns.
Texas A&M University cybersecurity rating report: https://www.rankiteo.com/company/texas-a&m-university
"id": "TEX1790153212",
"linkid": "texas-a&m-university",
"type": "Ransomware",
"date": "3/2019",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'location': 'Michigan, USA',
'name': 'Michigan-based company',
'type': 'Company'},
{'industry': 'Education',
'location': 'Texas, USA',
'name': 'Texas school',
'type': 'Educational institution'},
{'industry': 'Technology',
'location': 'Wilsonville, Oregon, USA',
'name': 'Technology firm',
'type': 'Company'}],
'attack_vector': 'Initial access brokerage',
'data_breach': {'data_encryption': 'Yes (Ryuk ransomware)',
'type_of_data_compromised': 'Encrypted data (Ryuk '
'ransomware)'},
'description': 'A 35-year-old Armenian national, Karen Serobovich Vardanyan, '
'was sentenced to 24 months in prison and three years of '
'supervised release for his involvement in Ryuk ransomware '
'attacks targeting U.S. organizations. Vardanyan specialized '
'in gaining initial access to corporate networks and deployed '
'Ryuk ransomware across hundreds of compromised servers and '
'workstations between March 2019 and June 2020.',
'impact': {'data_compromised': 'Data encrypted by Ryuk ransomware',
'financial_loss': '$15 million (total ransom payments)',
'operational_impact': 'Disruption of business operations',
'systems_affected': 'Hundreds of compromised servers and '
'workstations'},
'initial_access_broker': {'entry_point': 'Corporate networks'},
'investigation_status': 'Completed (sentencing issued)',
'motivation': 'Financial gain',
'post_incident_analysis': {'root_causes': 'Initial access brokerage by '
'Vardanyan'},
'ransomware': {'data_encryption': 'Yes',
'ransom_paid': '200 BTC (~$1.1 million) by Michigan-based '
'company; 1,610 BTC (~$15 million total)',
'ransomware_strain': 'Ryuk'},
'references': [{'source': 'U.S. Department of Justice'}],
'regulatory_compliance': {'legal_actions': '24 months prison sentence and '
'three years supervised release '
'for Vardanyan'},
'response': {'law_enforcement_notified': 'Yes (prosecutors involved)'},
'threat_actor': 'Karen Serobovich Vardanyan (Maneeken/Karl Lagerfeld), Wizard '
'Spider',
'title': 'Armenian Hacker Sentenced for Role in Ryuk Ransomware Attacks on '
'U.S. Companies',
'type': 'Ransomware'}