Karen Serobovich Vardanyan, a 35-year-old Armenian national who operated under the aliases "Maneeken" and "Karl Lagerfeld," received a 24-month prison sentence and three years of supervised release for his involvement in Ryuk ransomware attacks against American companies. Vardanyan, who focused on establishing initial footholds in corporate networks, entered a guilty plea in July following his extradition from Kyiv, Ukraine, where he had been arrested in April 2025.
Court filings document Vardanyan's participation in breaches of multiple U.S. organizations spanning from March 2019 through approximately June 2020. The attacks included a Michigan-based company that paid 200 BTC—valued at more than $1.1 million at the time of the attack—as well as a Texas school and a technology firm located in Wilsonville, Oregon.
Vardanyan and his co-conspirators illegally accessed computer networks of victim companies and deployed ransomware on hundreds of compromised servers and workstations
U.S. Department of Justice, July 2025
According to prosecutors, the conspiracy generated approximately 1,610 bitcoins in extorted payments, which totaled over $15 million when the ransom transfers occurred.
Ryuk operated as a ransomware-as-a-service platform from August 2018 until mid-2020, gaining notoriety for orchestrating a surge of attacks against healthcare organizations during the COVID-19 pandemic. The operation reached a peak where it compromised roughly 20 victims weekly and accumulated more than $150 million in ransom revenue.
Following Ryuk's closure in 2020, the Wizard Spider organization—the group responsible for Ryuk—transitioned to deploying Conti ransomware, which rapidly emerged as one of the most active criminal enterprises. Conti's operations ended in 2022 after internal communications and source code were publicly disclosed in May 2022, leading the group to fragment into multiple splinter organizations that either merged with existing ransomware collectives or established independent ventures.