Armenian National Karen Vardanyan Pleads Guilty to Ryuk Ransomware Conspiracy (District of Oregon)

Key facts for Ryuk Oregon guilty plea

Detection coverage for Ryuk Oregon guilty plea

As of 2026-07-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1192 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Ryuk Pre-Encryption Service Stop + Ransom Note Drop + Anchor_DNS C2 Beacon

Detects the documented late-stage Ryuk kill chain: net.exe service-stop sequences against backup/security/database services, the 'RyukReadMe' ransom-note artifact drop, and Anchor_DNS-style outbound queries to legitimate IP-lookup services used for C2 connectivity checks.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1489, T1490, T1486, T1568, T1041
• Data sources: sysmon, windows_security, dns_logs
• Severity: critical
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 Image="*\\net.exe" (CommandLine="*stop audioendpointbuilder*" OR CommandLine="*stop samss*" OR CommandLine="*stop MSSQL$*")
| eval technique="T1489"
| table _time, ComputerName, User, CommandLine, technique
| append
    [ search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11 TargetFilename="*RyukReadMe*"
      | eval technique="T1486,T1490" | table _time, ComputerName, Image, TargetFilename, technique ]
| append
    [ search index=network sourcetype="dns" (query="ipecho.net" OR query="api.ipify.org" OR query="checkip.amazonaws.com" OR query="icanhazip.com" OR query="ipinfo.io") NOT (process_name="chrome.exe" OR process_name="msedge.exe" OR process_name="firefox.exe")
      | eval technique="T1568,T1041" | table _time, ComputerName, query, process_name, technique ]
| sort - _time

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "net.exe" and ProcessCommandLine has_any ("stop audioendpointbuilder","stop samss","stop MSSQL$")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine
| union (
    DeviceFileEvents
    | where Timestamp > ago(24h)
    | where FileName has "RyukReadMe"
    | project Timestamp, DeviceName, InitiatingProcessFileName, FileName
)
| union (
    DeviceNetworkEvents
    | where Timestamp > ago(24h)
    | where RemoteUrl has_any ("ipecho.net","api.ipify.org","checkip.amazonaws.com","icanhazip.com","ipinfo.io")
    | where InitiatingProcessFileName !in~ ("chrome.exe","msedge.exe","firefox.exe")
    | project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl
)

Sigma

title: Ryuk Service-Stop, RyukReadMe Drop, and Anchor_DNS C2 Beacon
id: 8f2c1a90-1192-4003-9a01-000000000003
status: experimental
description: Detects the combined late-stage Ryuk footprint - net.exe service-stop against backup/security/database services, the RyukReadMe ransom-note artifact, and Anchor_DNS-style IP-lookup connectivity checks preceding/accompanying encryption.
references:
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-302a
    - https://www.huntress.com/threat-library/threat-actors/ransomware-group-ryuk
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-10
tags:
    - attack.impact
    - attack.t1489
    - attack.t1490
    - attack.t1486
    - attack.command_and_control
    - attack.t1568
    - attack.exfiltration
    - attack.t1041
    - attack.tool.trickbot
logsource:
    product: windows
    category: process_creation
detection:
    service_stop:
        Image|endswith: '\\net.exe'
        CommandLine|contains:
            - 'stop audioendpointbuilder'
            - 'stop samss'
            - 'stop MSSQL$'
    ransom_note:
        TargetFilename|contains: 'RyukReadMe'
    condition: service_stop or ransom_note
falsepositives:
    - Scheduled maintenance windows that legitimately stop the named services
level: critical

Known false positives:

• Scheduled maintenance windows that legitimately stop the named services
• Browser processes performing normal external-IP checks

Tuning notes: Alert immediately (do not batch) on the RyukReadMe filename match; correlate the service-stop sequence within a 5-minute window per host to reduce false positives from unrelated single-service restarts.

• 🔒 External Remote Services & Phishing Loader Execution (Sentinel) · unlock with TL Creds
• 🔒 Cobalt Strike Beaconing + SMB Admin-Share Lateral Movement (Sentinel) · unlock with TL Creds
• 🔒 Anchor_DNS IP-Lookup Beacon + DNS Tunneling C2 Detection (Sentinel) · unlock with TL Creds
• 🔒 Spearphishing Attachment Loader Chain (TrickBot/BazarLoader/Emotet) · unlock with TL Creds
• 🔒 Access Token Manipulation & Boot/Logon Autostart Persistence (Ryuk Post-Exploitation) · unlock with TL Creds
• 🔒 Ryuk Mass File Rename / Inhibit-System-Recovery (Shadow-Copy Deletion) Prior to Encryption · unlock with TL Creds
• 🔒 Ryuk Initial Access — Phishing Loader Spawn (TrickBot/BazarLoader/Emotet) & External Remote Service Logon · unlock with TL Creds
• 🔒 Ryuk Post-Exploitation — LSASS Credential Access & Valid-Account Reuse via WMI/Scheduled Task · unlock with TL Creds

Indicators of compromise for Ryuk Oregon guilty plea

As of 2026-07-10, Threadlinqs Intelligence tracks 20 indicators of compromise for TL-2026-1192.

Sample indicators (3 of 20)

• Domain: ipecho[.]net
• Domain: api[.]ipify[.]org
• Domain: checkip[.]amazonaws[.]com

Defanged, TLP:CLEAR. Full set of 20 indicators: unlock with TL Creds.

How Ryuk Oregon guilty plea works

He and co-conspirators extorted roughly 1,160-1,610 bitcoins (valued at over $15 million at the time) in ransom payments; a Michigan victim alone paid 200 BTC (~$1.1-1.2 million).

This threat record documents a criminal-justice milestone rather than a new technical exploitation event: the guilty plea of Karen Serobovich Vardanyan for his role in the Ryuk ransomware conspiracy operated by the Wizard Spider (also tracked as UNC1878/Team9/Grim Spider) cybercrime enterprise. Vardanyan was arrested in Kyiv, Ukraine in April 2025, extradited to the United States on June 18-19, 2025, and initially faced a seven-day jury trial set for August 26, 2025 before entering a guilty plea (announced July 10, 2026) to one count of conspiracy to commit computer fraud/wire fraud/extortion and one count of computer fraud. He faces a statutory maximum of 15 years' imprisonment (5 years for conspiracy, 10 years for computer fraud), fines up to $500,000, and has agreed to pay over $1.1 million in restitution; sentencing is scheduled for September 22, 2026. Three additional defendants were charged in the same indictment: Levon Georgiyovych Avetisyan (Armenian national, in custody in France pending extradition), and Ukrainian nationals Oleg Nikolayevich Lyulyava and Andrii Leonydovich Prykhodchenko (both remain at large).

Prosecutors allege the conspirators gained unauthorized access to victim networks and deployed Ryuk ransomware onto compromised servers and workstations, then extorted ransom payments in exchange for decryption keys. Named/described victims include a Michigan-based company that paid 200 BTC (~$1.1-1.2 million) in January 2020, a technology company in Wilsonville, Oregon breached in December 2019 (data and credentials stolen), and a private school in Texas compromised in February 2020. Total conspiracy proceeds across reporting range from ~1,160 BTC (per the July 2026 plea announcement, >$15M at the time) to ~1,610 BTC (per the original July 2025 indictment covering a broader March 2019-September 2020 window).

Ryuk itself is a well-documented enterprise ransomware family first observed in August 2018 as a derivative of Hermes 2.1, operated by the Russia-based Wizard Spider criminal enterprise as part of a 'big game hunting' strategy targeting organizations with the financial capacity to pay large ransoms. Ryuk campaigns typically begin with phishing emails delivering TrickBot, BazarLoader (BazarBackdoor), or Emotet as initial loaders; operators then use PowerShell, Windows Management Instrumentation (WMI), Cobalt Strike, and stolen/harvested credentials to move laterally (frequently via SMB/Windows admin shares and RDP), conduct reconnaissance and data exfiltration, and finally deploy the Ryuk binary, dropping a ransom note (commonly named 'RyukReadMe'), stopping security/backup-related services (e.g., via net.exe stop commands against services like audioendpointbuilder, samss, and MSSQL instances), and encrypting files to extort victims. TrickBot's Anchor_DNS module has been documented performing outbound connectivity checks against legitimate IP-lookup services (ipecho.net, api.ipify.org, checkip.amazonaws.com, ip.anysrc.net, wtfismyip.com, ipinfo.io, icanhazip.com, myexternalip.com) as part of its DNS-tunneling C2 channel. CISA's joint advisory (AA20-302A) previously warned of an imminent, credible threat of Ryuk deployment against the U.S. healthcare and public-health sector in coordination with TrickBot and BazarLoader activity. Ryuk operations wound down around 2020-2021 as the Wizard Spider enterprise transitioned much of its ransomware activity to the Conti brand.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003 OS Credential Dumping

Discovery

T1016 System Network Configuration Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery

Lateral Movement

T1021 Remote Services

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1055 Process Injection; T1078 Valid Accounts

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1053 Scheduled Task/Job; T1059 Command and Scripting Interpreter; T1106 Native API

Initial Access

T1133 External Remote Services; T1566 Phishing

Privilege Escalation

T1134 Access Token Manipulation

defense-impairment

T1222 File and Directory Permissions Modification; T1685 Disable or Modify Tools

Impact

T1486 Data Encrypted for Impact; T1489 Service Stop; T1490 Inhibit System Recovery

Persistence

T1547 Boot or Logon Autostart Execution

Command and Control

T1568 Dynamic Resolution

Remediation for Ryuk Oregon guilty plea

Immediate actions

• Disable or restrict RDP exposure to the internet; enforce MFA and account lockout on all remote access services
• Block outbound access to known TrickBot/BazarLoader C2 infrastructure and monitor for Anchor_DNS-style DNS tunneling to IP-lookup services
• Isolate and rebuild any host showing TrickBot, BazarLoader, or Emotet loader activity before ransomware deployment occurs
• Preserve and monitor for the 'RyukReadMe' ransom-note artifact and net.exe service-stop command sequences as late-stage indicators

Workarounds

• Restrict SMB (445/tcp) and RDP (3389/tcp) between workstation and server VLANs where legacy segmentation prevents full patching/hardening

Longer-term hardening

• Deploy EDR with behavioral detection for Cobalt Strike beaconing, WMI-based lateral movement, and mass file encryption
• Maintain offline, tested, immutable backups to eliminate ransom leverage
• Segment networks to limit SMB/Windows-admin-share lateral movement between business-critical systems
• Adopt phishing-resistant email filtering and user training targeting malicious-attachment-based loader delivery

Affected and fixed versions

• Unknown — Enterprise Windows networks (unnamed Michigan-based company)
  Vulnerable versions: victim environment, January 2020
• Unknown — Technology company network, Wilsonville, Oregon
  Vulnerable versions: victim environment, December 2019
• Unknown — Private school network, Texas
  Vulnerable versions: victim environment, February 2020

Timeline of Ryuk Oregon guilty plea

• 2018-08-01 locked-ioc-20 ransomware first observed in the wild, a derivative of Hermes 2.1 ransomware, operated by the locked-ioc-12 cybercrime enterprise.
• 2019-03-01 Per the original July 2025 indictment, Vardanyan and co-conspirators began infiltrating victim networks to deploy locked-ioc-20 ransomware (broader charged window: March 2019-September 2020).
• 2019-11-01 Per the guilty plea, Vardanyan's admitted deployment of locked-ioc-20 ransomware against U.S. victims begins (November 2019).
• 2019-12-01 A technology company in Wilsonville, Oregon is breached; data and credentials are stolen ahead of ransomware deployment.
• 2020-01-01 A Michigan-based company pays approximately 200 bitcoin (~$1.1-1.2 million at the time) in ransom to restore network access.
• 2020-02-01 A private school in Texas is breached and hit with locked-ioc-20 ransomware.
• 2020-04-01 Admitted conspiracy period in the guilty plea ends (April 2020); conspirators are alleged to have collected approximately 1,160-1,610 bitcoins in total ransom proceeds, valued at over $15 million at the time.
• 2025-04-01 Karen Vardanyan is arrested in Kyiv, Ukraine.
• 2025-06-18 Vardanyan is extradited from Ukraine to the United States; he appears in U.S. federal court the following day.
• 2025-07-16 DOJ publicly announces federal charges against Vardanyan (conspiracy, computer fraud, extortion) following his extradition; co-conspirators Avetisyan, Lyulyava, and Prykhodchenko are also charged.
• 2025-08-26 A seven-day jury trial is scheduled to begin in the U.S. District Court for the District of Oregon.
• 2026-07-08 Vardanyan pleads guilty in Oregon federal court to conspiracy and computer fraud, agreeing to pay over $1.1 million in restitution.
• 2026-07-10 U.S. Attorney's Office for the District of Oregon and press outlets publicly announce the guilty plea.
• 2026-09-22 Sentencing hearing scheduled before a U.S. District Court judge in Oregon; Vardanyan faces up to 15 years' imprisonment and $500,000 in fines.

Sources cited for Ryuk Oregon guilty plea

• District of Oregon | Armenian National Extradited to the United States Pleads Guilty to Ransomware Extortion Conspiracy justice.gov · Government advisory · 2026-07-10
• Ransomware Activity Targeting the Healthcare and Public Health Sector (AA20-302A) CISA · Advisory · 2020-10-28
• Ryuk, Software S0446 | MITRE ATT&CK MITRE · Research
• Threat Assessment: Ryuk Ransomware Unit 42 · Vendor report
• Ryuk Ransomware Threat Actor Profile - Big Game Hunting TTPs Huntress · Vendor report
• Armenian national pleads guilty in Ryuk ransomware case cyberscoop.com · News · 2026-07-10
• Ryuk operator pleads guilty; Blackcat/AlphV conspirator gets nearly 6-year sentence The Record · News · 2026-07-10
• Ryuk ransomware operator extradited to US, faces five years in federal prison cyberscoop.com · News · 2025-07-16
• Ryuk Ransomware Indictments: U.S. Charges Armenian and Ukrainian Nationals in Global Ransomware therealistjuggernaut.com · News · 2025-07-17
• Armenian National Extradited to the United States Faces Federal Charges for Ransomware Extortion Conspiracy databreaches.net · News · 2025-07-16

Threats related to Ryuk Oregon guilty plea

• Qilin Ransomware: Custom Rust Loader and Kernel-Level EDR Killer via Weaponized ThrottleStop Driver (CVE-2025-7771)
• Amadey: Commodity Loader/Botnet Evolved into RAT — Dominant LockBit 3.0 Loader, Adopted by FSB's Secret Blizzard Against Ukrainian Military

More from Periwinkle Tempest

• DIAVOL Ransomware – Reverse Engineering Analysis (Wizard Spider-linked, .lock64)
• Ryuk Ransomware Attacks via Emotet and Trickbot Chain; North Korean (Lazarus) Attribution Questioned
• TrickBot injectDLL Module: Man-in-the-Browser Web Injection Against Certificate Transparency
• TrickBot Banking Trojan (Anchor_DNS) Uses DNS Tunneling Over westurn.in for Covert C2
• TrickBot Malware Variant Adopts DNS Tunneling for C2 Communications (westurn.in)
• SystemBC (Coroxy / DroxiDat) Malware: Multi-Purpose SOCKS5/Tor Proxy Backdoor Enabling Ransomware Operations

Previous and next in ransomware

• Everest Ransomware: Triple Extortion via Encryption, Access Brokering, and Insider Recruitment Previous report
• FulcrumSec Double-Extortion Data Theft of Global Schools Foundation (GSF) EdTech Network via Unrotated 2022 MongoDB Credentials Next report