PORTLAND, Ore.— An Armenian national extradited from Ukraine to the United States pleaded guilty yesterday for his role in Ryuk ransomware attacks and an extortion conspiracy targeting companies throughout the United States, including a technology company operating in Oregon.
Karen Serobovich Vardanyan, 34, pleaded guilty to conspiracy and computer fraud.
According to court documents, between November 2019 through April 2020, Vardanyan illegally accessed computer networks of victim companies to deploy Ryuk ransomware on compromised servers and workstations. Ryuk ransomware is a type of malicious software designed to encrypt data on a victim’s computer or network and prevents the victim from accessing the encrypted files until a ransom is paid.
As part of the scheme, ransom payments were extorted from victim companies in exchange for decryption keys to regain access to their data. A ransom note was placed on the computer systems demanding ransom payments in Bitcoin, a form of cryptocurrency, and provided an email address that victims could use to communicate with the cybercriminals.
Vardanyan worked with his co-conspirators to attack a company in Michigan that paid 200 bitcoin or over $1.1 million at the time of payment to restore access to their network. They also attacked a company in Wilsonville, Oregon, and in February 2020 attacked a school in Texas.
Vardanyan and his co-conspirators illegally accessed computer networks of victim companies and deployed ransomware on hundreds of compromised servers and workstations. Vardanyan and his co-conspirators are alleged to have received approximately 1,610 bitcoins in ransom payments from the victim companies, which was valued at over $15 million at the time of payment.
On Feb. 22, 2024, a federal grand jury in Portland returned a three-count indictment charging Vardanyan with conspiracy, computer fraud, and extortion.
Vardanyan faces a maximum sentence of five years in prison, a $250,000 fine, and three years of supervised release for conspiracy. He faces a maximum sentence of 10 years in prison, a $250,000 fine, and three years of supervised release for computer fraud. Vardanyan will be sentenced on Sept, 22. 2026, buy a U.S. district court judge.
As part of the plea agreement, Vardanyan has agreed to pay over $1.1 million in restitution.
U.S. Attorney Scott E. Bradford for the District of Oregon made the announcement.
The case is being investigated by the FBI. It is being prosecuted by Katherine A. Rykken, Assistant U.S. Attorney for the District of Oregon.
The Justice Department’s Office of International Affairs provided significant assistance in securing Vardanyan’s arrest and extradition from Ukraine. The U.S. Attorney’s Office thanks the Ukrainian authorities for their assistance in this matter.
# # #