Ryuk operator Karen Vardanyan sentenced to 2 years US prison; ACSC tied Ryuk to 2019 Victorian health attacks
iTnews (25 September 2026 05:05 AEST) reports that a US court sentenced Karen Vardanyan (aliases Manekeen / Karl Lagerfeld), an Armenian national extradited from Kyiv in 2025, to two years’ federal prison and about US$1.219 million in restitution after a July 2026 guilty plea to conspiracy and computer fraud tied to Ryuk ransomware operations from 2019. Wire cites US prosecutors that Ryuk took at least US$15 million in extortion; other alleged Ryuk members named in reporting include Levon Avetisyan, Oleg Lyulyava and Andrii Prikhodchenko. Australia angle: ACSC previously attributed a 2019 Victorian healthcare-sector attack (Gippsland Health Alliance and South West Alliance of Rural Health) to Ryuk operators — iTnews notes it is not clear whether Vardanyan was involved in those AU incidents. Primary notice URL: US Attorney’s Office District of Oregon press release (fetch blocked from this desk; facts from iTnews wire quoting prosecutors). Distinct from Conti/Ryuk historical KEV material.
- Product
- Ryuk ransomware (historical Conti-era affiliate operations)
- Versions
- n/a (criminal sentence / historical AU healthcare attribution)
- Exploited in Australia?
- yes
- Patch to
- Historical AU health-sector lesson: maintain offline recoverable backups, network segmentation for clinical systems, and tested IR playbooks for ransomware; treat Conti/Ryuk-era TTPs as still relevant for affiliate successors; no product patch for this sentencing story
Primary: USAO District of Oregon — Armenian national sentenced for ransomware extortion (DOJ PR URL) · Vendor: iTnews — Ryuk ransomware raider sentenced to two years prison (25 Sep 2026) · iTnews wire (AU) — Vardanyan sentence + ACSC 2019 Victorian health Ryuk attribution