An Armenian national has pleaded guilty in a U.S. case tied to a Ryuk ransomware campaign that prosecutors said brought in more than $15 million in bitcoin from American organizations. The case centers on attacks carried out between late 2019 and early 2020 that disrupted corporate networks and left victims paying for decryption tools in cryptocurrency.

The Guilty Plea

Karen Serobovich Vardanyan, 34, pleaded guilty on July 8 to conspiracy and computer fraud, according to federal prosecutors. Authorities said he took part in a Ryuk ransomware operation active from November 2019 through April 2020. Vardanyan was extradited from Ukraine to face the case in the United States.

Prosecutors alleged that the campaign targeted U.S. organizations and extracted about 1,610 bitcoin in total. At the time of those payments, the amount was worth more than $15 million.

How the Attacks Worked

According to the case, victims found files encrypted, workstations disabled, and company data rendered inaccessible after attackers entered their networks. Prosecutors said the group then deployed Ryuk across hundreds of servers and computers, using the damage and business disruption to pressure organizations into paying for recovery.

Payment demands directed victims to use bitcoin and communicate with the attackers by email. That exchange allegedly allowed the group to negotiate with organizations that had been locked out of their systems, verify that transfers had been made, and then send decryption keys intended to restore access once funds reached wallets controlled by the conspirators.

Named Victims and Payments

Among the incidents cited by prosecutors was a Michigan business that paid 200 bitcoin to recover control of its network. The payment was worth more than $1.1 million when it was made. The case also references attacks involving a technology company in Wilsonville, Oregon, and a Texas school that was hit in February 2020.

The source article does not identify those organizations by name, but it describes the broader operation as one that affected hundreds of corporate systems during the period covered by the plea.

Sentencing and Restitution

Under the plea agreement, Vardanyan must pay more than $1.1 million in restitution. He faces a maximum sentence of five years in prison on the conspiracy count and 10 years for computer fraud, in addition to possible fines and supervised release.

Sentencing is scheduled for September 22, 2026. The plea resolves his admission of involvement, but the penalties will be determined at that hearing.

The case adds another court record to the long-running effort by U.S. authorities to pursue ransomware actors and track cryptocurrency payments tied to extortion schemes. In this matter, prosecutors tied the Ryuk operation to alleged bitcoin collections from U.S. victims over a six-month span, while the court process now moves to sentencing.

Source: news.bitcoin.com