A court in the United States has handed down a 24-month prison sentence to Karen Serobovich Vardanyan, also known online as ‘Maneeken’ or ‘Karl Lagerfeld’, for his role in Ryuk ransomware sentencing proceedings that drew on attacks targeting multiple US organisations between 2019 and 2020. Vardanyan, 35, was also ordered to serve three years of supervised release.
Vardanyan, an Armenian national, specialised in gaining initial access to corporate networks before handing that foothold to co-conspirators who deployed the ransomware payload. He pleaded guilty in July after being extradited from Kyiv, Ukraine, following his arrest in April 2025. According to The Record from Recorded Future News, he had faced a maximum exposure of up to 15 years in prison and as much as $500,000 in fines, making the 24-month term a considerably lighter outcome than prosecutors could have pursued.
The attacks: healthcare, schools and a Michigan ransom in bitcoin
Court documents show that Vardanyan hacked into the networks of multiple US organisations in Ryuk ransomware attacks between March 2019 and approximately June 2020. The Record reports that for roughly six months beginning in November 2019, he was actively accessing companies’ networks to deploy Ryuk, a period that coincided with the operation’s most aggressive phase.
In one case, Vardanyan and his accomplices breached a Michigan company that paid 200 BTC, worth over $1.1 million at the time. Prosecutors also identified a school in Texas and a technology company in Wilsonville, Oregon among the victims.
The scale of the broader conspiracy was substantial. ‘Vardanyan and his co-conspirators illegally accessed computer networks of victim companies and deployed ransomware on hundreds of compromised servers and workstations,’ the U.S. Department of Justice said in July. The DoJ added that the group ‘are alleged to have received approximately 1,610 bitcoins in ransom payments from the victim companies, which was valued at over $15 million at the time of payment.’
Ryuk ransomware: from healthcare attacks to the Conti splinter
Ryuk was a ransomware-as-a-service (RaaS) operation active between August 2018 and mid-2020. It became particularly notorious for launching a wave of attacks against the healthcare sector during the COVID-19 pandemic, a period when the pressure on hospitals and medical providers made them especially vulnerable targets. At its peak, the group was hacking around 20 victims every week and ultimately collected more than $150 million in ransoms.
The cybercrime gang behind Ryuk, known as Wizard Spider, shut the operation down in 2020 and pivoted to Conti ransomware, which rapidly established itself as one of the more prolific operations of its era. Conti’s run ended in 2022 after its internal chats and source code were leaked in May of that year, causing the group to splinter into multiple smaller units. Some of those units infiltrated existing ransomware gangs; others launched new operations of their own.
Vardanyan’s extradition from Ukraine and subsequent conviction represent one of the more concrete law-enforcement outcomes connected to the Ryuk era, a period that reshaped expectations about the financial damage ransomware groups could inflict on critical infrastructure. His Ryuk ransomware sentencing, as covered by The Record from Recorded Future News, comes years after the operation itself went dark, a reminder that the legal tail on major ransomware cases can stretch well past the point at which the malware itself disappears from the threat landscape.
Vardanyan’s three-year supervised release period begins upon completion of his custodial term.
