Karen Vardanyan's 24-month Ryuk sentence is mostly time he has already served

Thirteen months of the term were served before the guilty plea. SecurityWeek dates the extradition to June 2025 ^[4]; The Record says July 2025 ^[5]. Vardanyan pleaded guilty on July 8 ^[7], 2026 ^[6]. Taking the earlier date, that is 13 months in custody before he entered the plea ^[1], leaving at most 11 months of the 24 ^[2], and the sentencing hearing came later still. His conviction will have immigration consequences resulting in removal from the United States after he serves the sentence ^[25].

The government made the deterrence argument itself. "Like Vardanyan, many cybercriminals are not masterminds of a complex ransomware or extortion scheme but nonetheless play an integral part in the success of these crimes," read a memo signed by U.S. attorneys in the District of Oregon ^[19]. "Unfortunately, high rewards and a relatively low risk of detection are basic features of cybercrime. The only way to affect the cost-benefit analysis of these crimes is to impose meaningful sentences on those who are caught," the attorneys added ^[20]. The sentence matches the terms of the plea agreement he reached with prosecutors, CyberScoop reported ^[10]. Prosecutors also said they found no evidence he was still engaged in criminal activity at the time of his arrest ^[24].

Rank sets the tier. The record on his rank is split. The Record reported that prosecutors called him a core member of the Ryuk gang and cited court documents describing more than 2,400 attacks worldwide ^[16]. BleepingComputer says he specialized in gaining initial access to corporate networks and used the handles "Maneeken" and "Karl Lagerfeld" ^[17]. SecurityWeek describes him as likely an affiliate or initial access provider on the basis of the DOJ's account, with malware development and infrastructure sitting with others ^[18]. A Ukrainian Conti developer drew four years in a US court this year ^[26], and a Swiss court gave 13 years to a Ukrainian accused of creating LockerGoga, MegaCortex and Nefilim ^[27].

Extradition worked fast: arrest in Kyiv in April 2025 ^[3], transfer to the United States roughly two months later ^[5], on charges a grand jury returned in February 2024 ^[2]. Three co-conspirators are named: Ukrainians Oleg Nikolayevich Lyulyava and Andrii Leonydovich Prykhodchenko, both 53, and Armenian national Levon Georgiyovych Avetisyan ^[21]. The Record reports several members of the group have been identified and arrested over the past three years ^[22], and a Russian man pleaded guilty in an Oregon federal court in 2023 to laundering Ryuk funds ^[23]. The sources do not say how many requests were made or refused.

Most of the money is gone. CyberScoop puts the DOJ figure for the crew's ransom receipts at about 1,160 bitcoins, worth more than $15 million at the time of payment ^[14]; BleepingComputer quotes the DOJ at approximately 1,610 bitcoins against the same $15 million valuation ^[15], a gap of 450 coins between the two accounts ^[4]. Restitution here is $1,219,106 ^[9], about 8 percent of $15 million ^[3]. One Michigan victim paid 200 BTC, worth over $1.1 million at the time ^[30]. Universal Health Services, hit in the same era, ultimately spent $67 million on its Ryuk attack ^[28], and at its peak the operation was hitting around 20 victims a week and collecting more than $150 million ^[29].