Armenian National Pleads Guilty in Ryuk Ransomware Case That Hit Oregon Tech Company

An Armenian national extradited from Ukraine to the United States, 34-year-old Karen Serobovich Vardanyan, pleaded guilty to conspiracy charges on Wednesday for his role in Ryuk ransomware attacks and an extortion conspiracy targeting companies throughout the US, including a technology company operating in Oregon.

Armenian Pleads Guilty To Charges Related to Oregon Ransomware Attack

Court documents indicate that, between November 2019 and April 2020, Vardanyan, an Armenian national, illegally accessed computer networks of victim companies. He deployed Ryuk ransomware on compromised servers and workstations.

The ransomware prevents the victim from accessing the encrypted files until a ransom is paid. A ransom note on the computer systems demanded ransom payments in Bitcoin.

Vardanyan and his co-conspirators attacked a Michigan company that paid 200 bitcoin (over $1.1 million at the time) to restore access to their network.

The group also attacked a company in Wilsonville, Oregon, and in February 2020 attacked a school in Texas. The group allegedly received approximately 1,610 bitcoins in ransom payments from victim companies (valued at over $15 million at the time).

A federal grand jury in Portland returned a three-count indictment on February 22, 2024,  charging Vardanyan with conspiracy, computer fraud, and extortion. The U.S. Attorney’s Office, District of Oregon, confirmed that Vardanyan pleaded guilty to conspiracy and computer fraud.

Vardanyan faces penalties:

• For Conspiracy: A maximum sentence of five years in prison, a $250,000 fine, and three years of supervised release for conspiracy.
• For computer fraud: A maximum sentence of 10 years in prison, a $250,000 fine, and three years of supervised release for computer fraud.
• Payment of over $1.1 million in restitution.

Vardanyan will be sentenced on Sept, 22. 2026, by a U.S. district court judge.