Karen Serobovich Vardanyan, a 34-year-old Armenian national extradited from Ukraine, has pleaded guilty to conspiracy and computer fraud related to a Ryuk ransomware campaign that extorted over $15 million in Bitcoin from various businesses across the United States. This plea was entered on July 8, with Vardanyan potentially facing a sentence of up to 15 years, pending a judge's decision this autumn.
Vardanyan's criminal activities are part of a broader scheme that operated between November 2019 and April 2020. According to the US Attorney's Office for the District of Oregon, the ransomware infiltrated corporate networks, locking users out of their systems until a ransom was paid. This malicious software, known as Ryuk, encrypted files and displayed ransom notes that instructed victims to pay the extortion fee in Bitcoin and provided a contact email for negotiations.
Victims of Vardanyan's scheme included a Michigan-based company that paid 200 Bitcoin, as well as victims in Oregon and Texas. As part of his plea agreement, Vardanyan has committed to paying over $1.1 million in restitution to the affected parties.
The prosecution detailed that each charge carries substantial penalties: conspiracy can result in a five-year prison term, and computer fraud could lead to a ten-year sentence. Additionally, each count could involve fines of up to $250,000 and three years of supervised release. Vardanyan has also been charged with a third count of extortion, which remains unaddressed by his guilty plea.
The Department of Justice disclosed in a July 9 press release that the ransomware campaign left victims unable to access their data until a ransom was fulfilled. Once the ransom was paid into the attackers' Bitcoin wallet, the victims received decryption keys to regain access to their files.
This article is for informational purposes only and does not constitute financial advice.
