An Armenian national extradited from Ukraine has pleaded guilty in the United States to conspiracy and computer fraud in connection with a Ryuk ransomware campaign that prosecutors say extracted more than $15 million in bitcoin from US businesses.

The defendant, Karen Serobovich Vardanyan, 34, entered his plea on July 8 in Oregon. As part of the case, he agreed to pay more than $1.1 million in restitution. He is scheduled to be sentenced later this year and could face up to 15 years in prison across the two counts.

Timeline of the scheme

Federal prosecutors said the ransomware operation ran from November 2019 through April 2020. During that period, attackers allegedly gained access to corporate networks and deployed Ryuk malware to lock files and disrupt operations.

According to the prosecution, the malware was installed across hundreds of workstations and servers. Victim systems were then left with ransom notes that included an email address and bitcoin details for negotiations. Prosecutors said the attackers controlled the wallet used in the process and provided decryption keys after payment was made.

Victims and payments

US authorities said the campaign targeted multiple organizations, including a company in Michigan, a technology firm in Wilsonville, Oregon, and a school in Texas. One Michigan business paid 200 bitcoin to recover access to its systems, an amount prosecutors valued at more than $1.1 million at the time.

In total, the operation is said to have collected about 1,610 bitcoin from victims. Prosecutors estimated the value of those payments at more than $15 million when they were made.

Plea and sentencing process

Vardanyan admitted guilt on the conspiracy and computer fraud charges tied to his role in the operation. The plea agreement includes restitution of more than $1.1 million, though that figure is still subject to review by the court.

A US District Judge is set to consider the restitution amount, the plea agreement, and federal sentencing guidelines at a hearing scheduled for September 22, 2026. Prosecutors have said sentencing is expected this autumn.

Investigation and extradition

The FBI investigated the case, according to the US Attorney’s Office for the District of Oregon. US authorities also said the Department of Justice worked with Ukrainian officials to secure Vardanyan’s arrest and extradition from Ukraine.

The case adds to a broader record of US prosecutions linked to Ryuk, a ransomware strain long associated with attacks on businesses and institutions. In this instance, prosecutors tied Vardanyan to a campaign aimed at US organizations and said the proceeds were collected in bitcoin over several months before the operation was disrupted through investigation and extradition.

Source: Cryptopolitan