U.S. prosecutors announced two separate milestones this week in ongoing efforts to dismantle major ransomware operations, one targeting the Ryuk gang and another tied to the Blackcat/AlphV group.
Ryuk operator admits guilt
Karen Serobovich Vardanyan, a 34-year-old Armenian national, pleaded guilty in an Oregon federal court to conspiracy and computer fraud charges. Prosecutors said that for roughly six months beginning in November 2019, Vardanyan accessed corporate networks to deploy Ryuk ransomware.
According to prosecutors, Vardanyan and his co-conspirators attacked a Michigan company that ultimately paid 200 bitcoin (over $1.1 million at the time) to restore network access. They also targeted a company in Wilsonville, Oregon, and a Texas school in February 2020.
Vardanyan was arrested in Kyiv in April 2025 and extradited to the U.S. in June. He faces up to 15 years in prison and fines of up to $500,000, and has agreed to pay more than $1.1 million in restitution. Sentencing is scheduled for September 22.
The case connects to other pending prosecutions. Armenian national Levon Georgiyovych Avetisyan has been charged with conspiracy, fraud, and extortion and was reportedly in custody in France. Ukrainian nationals Oleg Nikolayevich Lyulyava and Andrii Leonydovich Prykhodchenko face similar charges but were not in custody as of last year.
Ryuk first emerged in August 2018, targeting large organizations with high-dollar ransom demands. Researchers and law enforcement have long linked the group to other major cybercrime infrastructure, including Conti and Trickbot.
Negotiator turned informant sentenced
Separately, Angelo Martino, 41, of Land O’Lakes, Florida, was sentenced to 70 months in federal prison for helping the Blackcat/AlphV gang extort multiple victims starting in April 2023.
Martino, who worked as a ransomware negotiator, was paid by BlackCat attackers to leak confidential details about clients’ negotiating positions and strategy, allowing the group to maximize ransom payments, prosecutors said. He surrendered to U.S. Marshals in March and pleaded guilty in April to an extortion charge.
Two others connected to the same scheme, Ryan Goldberg and Kevin Martin, pleaded guilty to extortion charges earlier this year and received four-year sentences in May. Martin and Martino both worked as negotiators for DigitalMint, while Goldberg was employed by incident response firm Sygnia.
In response, DigitalMint has implemented new controls requiring all negotiations to occur over auditable, cloud-based platforms, with one of the company’s founders personally overseeing every negotiation.