Karen Serobovich Vardanyan, an Armenian national, has pleaded guilty to running a ransomware campaign that hit multiple U.S. companies and at least one private school using Ryuk ransomware. Prosecutors put the total extortion proceeds at roughly $15 million, including a single Michigan victim that paid more than $1.1 million in Bitcoin to regain access to its own network. Vardanyan was extradited from Ukraine to face the charges. Three alleged co-conspirators remain at large, with one believed to be in France.
What Happened
The scheme followed the pattern that made Ryuk one of the most profitable ransomware families of its era: identify organizations with exploitable or poorly defended systems, gain access, deploy the encryptor across the environment, and demand payment in Bitcoin for a decryption key. Victims spanned commercial businesses and a private school, a mix that reflects Ryuk's operators targeting by opportunity and ability to pay rather than by sector.
The guilty plea is the product of a multi year international effort. Vardanyan was located and extradited from Ukraine, a step that required cooperation between U.S. investigators and Ukrainian authorities. That extradition is the notable part of this case. Ransomware operators have long relied on the assumption that geography insulates them from prosecution, and this outcome erodes that assumption without eliminating it, given that most of the alleged crew is still unaccounted for.
The financial trail was central to the case. Bitcoin gave the operators pseudonymity, not anonymity, and blockchain analysis has repeatedly proven capable of tying wallet clusters to real identities once a single off ramp is compromised.
What Was Taken
The confirmed harm in this case is encryption and extortion rather than a publicly documented data leak. Victim organizations lost availability of their production systems: file shares, business applications, and in the school's case the administrative systems a small institution depends on daily. The Michigan victim paid over $1.1 million specifically to restore network access, which indicates the encryption reached systems the organization could not rebuild from backups in an acceptable timeframe.
Ryuk deployments were typically the final stage of an intrusion chain that began with commodity malware such as TrickBot or Emotet, and those loaders routinely harvested credentials, browser data, and email before the encryptor ever ran. Organizations that were hit by Ryuk should treat credential compromise as likely even where no data leak was ever published. The public record here does not detail exfiltration volumes, so defenders should read the $15 million figure as the measure of extortion revenue, not the measure of total data exposure.
Why It Matters
Fifteen million dollars from a crew of four is an extraordinary return on a small operation, and that math is the reason ransomware persists. Every payment funds tooling, infrastructure, and recruitment for the next campaign.
For defenders, three things stand out. First, the victim mix confirms that mid market companies and small institutions like private schools are squarely in scope. These organizations rarely have a 24/7 security operations center, and attackers know it. Second, the $1.1 million single payment shows what happens when backups are either encrypted, absent, or too slow to restore. The ransom was cheaper than the outage. Third, the extradition matters strategically: law enforcement pressure is now a real, if inconsistent, cost of doing business for these actors, and it changes how they select safe havens and launder proceeds.
The case is also a reminder that arrests lag attacks by years. The defensive posture that would have stopped this campaign is the same posture that stops today's affiliates of newer ransomware brands.
The Attack Technique
Ryuk operations historically depended on a well documented chain rather than novel exploitation. Initial access commonly came from phishing that delivered a loader, from exposed remote desktop services with weak or reused credentials, or from an existing infection sold on by another criminal group. From there operators harvested credentials, escalated to domain administrator, disabled or deleted volume shadow copies and backups, and pushed the encryptor to every reachable host, often over SMB or via Group Policy and remote management tooling.
Two properties made this deadly. The dwell time between initial access and encryption gave operators time to map the environment and find the backup infrastructure, and the final encryption event was executed across the estate at once, usually outside business hours. Payment was demanded in Bitcoin to a wallet unique to the victim, which is precisely what later allowed investigators to cluster and follow the funds.
What Organizations Should Do
- Make backups genuinely recoverable and genuinely offline. Keep at least one immutable or air gapped copy, restrict backup service accounts from the production domain, and test a full restore against a real recovery time objective rather than assuming one.
- Eliminate exposed remote access. Audit the external perimeter for RDP, VPN appliances, and management interfaces, put multi factor authentication on every remote entry point, and treat any single factor remote login as an open door.
- Hunt for the precursor, not just the payload. Ryuk style encryption is the last step. Alert on shadow copy deletion, backup agent tampering, mass service stops, and new domain administrator accounts, since those precede encryption by hours.
- Segment the network and constrain lateral movement. Block workstation to workstation SMB, tier administrative credentials so a helpdesk account cannot reach a domain controller, and limit which hosts may run remote execution tooling.
- Assume credential theft after any commodity malware detection. Force enterprise wide password resets, rotate Kerberos ticket signing keys twice, and revoke sessions rather than simply cleaning the infected host.
- Write and rehearse the ransom decision in advance. Decide who authorizes payment, who engages counsel and law enforcement, and what the offline operating plan looks like, because the Michigan victim's $1.1 million payment reflects a decision made under pressure without a workable alternative.
- Preserve evidence and report early. Blockchain tracing and international prosecution both depend on victim reporting, and this case only reached a guilty plea because victims cooperated.
Sources: Armenian Hacker Pleads Guilty: $15 Million Ransomware Attacks in the US (2026)