# Armenian National Karen Vardanyan Pleads Guilty to Ryuk Ransomware Conspiracy (District of Oregon)

> Karen Serobovich Vardanyan, a 34-year-old Armenian national extradited from Ukraine in June 2025, pleaded guilty in the U.S. District Court for the District of Oregon to conspiracy and computer fraud for deploying Ryuk ransomware against at least five U.S. companies and a Texas private school between November 2019 and April 2020. He and co-conspirators extorted roughly 1,160-1,610 bitcoins (valued at over $15 million at the time) in ransom payments; a Michigan victim alone paid 200 BTC (~$1.1-1.2 million).

- **Published:** 2026-07-10T00:00:00Z
- **Last reviewed:** 2026-07-10T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1192
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-ryuk-oregon-guilty-plea-tl-2026-1192.webp?v=77aecb44 (Threadlinqs threat intel: Ryuk Ransomware Guilty Plea in Oregon: Detection & IOCs (TL-2026-1192) — High severity, 20 IOCs, 9 detection rules.)
- **ID:** TL-2026-1192
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** RESOLVED
- **Actor:** Periwinkle Tempest (Russia)
- **Detections:** 9 (1 shown free below) · **IOCs:** 20 (3 shown free below)

## Description

This threat record documents a criminal-justice milestone rather than a new technical exploitation event: the guilty plea of Karen Serobovich Vardanyan for his role in the Ryuk ransomware conspiracy operated by the Wizard Spider (also tracked as UNC1878/Team9/Grim Spider) cybercrime enterprise. Vardanyan was arrested in Kyiv, Ukraine in April 2025, extradited to the United States on June 18-19, 2025, and initially faced a seven-day jury trial set for August 26, 2025 before entering a guilty plea (announced July 10, 2026) to one count of conspiracy to commit computer fraud/wire fraud/extortion and one count of computer fraud. He faces a statutory maximum of 15 years' imprisonment (5 years for conspiracy, 10 years for computer fraud), fines up to $500,000, and has agreed to pay over $1.1 million in restitution; sentencing is scheduled for September 22, 2026. Three additional defendants were charged in the same indictment: Levon Georgiyovych Avetisyan (Armenian national, in custody in France pending extradition), and Ukrainian nationals Oleg Nikolayevich Lyulyava and Andrii Leonydovich Prykhodchenko (both remain at large).

Prosecutors allege the conspirators gained unauthorized access to victim networks and deployed Ryuk ransomware onto compromised servers and workstations, then extorted ransom payments in exchange for decryption keys. Named/described victims include a Michigan-based company that paid 200 BTC (~$1.1-1.2 million) in January 2020, a technology company in Wilsonville, Oregon breached in December 2019 (data and credentials stolen), and a private school in Texas compromised in February 2020. Total conspiracy proceeds across reporting range from ~1,160 BTC (per the July 2026 plea announcement, >$15M at the time) to ~1,610 BTC (per the original July 2025 indictment covering a broader March 2019-September 2020 window).

Ryuk itself is a well-documented enterprise ransomware family first observed in August 2018 as a derivative of Hermes 2.1, operated by the Russia-based Wizard Spider criminal enterprise as part of a 'big game hunting' strategy targeting organizations with the financial capacity to pay large ransoms. Ryuk campaigns typically begin with phishing emails delivering TrickBot, BazarLoader (BazarBackdoor), or Emotet as initial loaders; operators then use PowerShell, Windows Management Instrumentation (WMI), Cobalt Strike, and stolen/harvested credentials to move laterally (frequently via SMB/Windows admin shares and RDP), conduct reconnaissance and data exfiltration, and finally deploy the Ryuk binary, dropping a ransom note (commonly named 'RyukReadMe'), stopping security/backup-related services (e.g., via net.exe stop commands against services like audioendpointbuilder, samss, and MSSQL instances), and encrypting files to extort victims. TrickBot's Anchor_DNS module has been documented performing outbound connectivity checks against legitimate IP-lookup services (ipecho.net, api.ipify.org, checkip.amazonaws.com, ip.anysrc.net, wtfismyip.com, ipinfo.io, icanhazip.com, myexternalip.com) as part of its DNS-tunneling C2 channel. CISA's joint advisory (AA20-302A) previously warned of an imminent, credible threat of Ryuk deployment against the U.S. healthcare and public-health sector in coordination with TrickBot and BazarLoader activity. Ryuk operations wound down around 2020-2021 as the Wizard Spider enterprise transitioned much of its ransomware activity to the Conti brand.

## MITRE ATT&CK

- T1134 Access Token Manipulation
- T1547 Boot or Logon Autostart Execution
- T1059 Command and Scripting Interpreter
- T1486 Data Encrypted for Impact
- T1685 Disable or Modify Tools
- T1083 File and Directory Discovery
- T1222 File and Directory Permissions Modification
- T1490 Inhibit System Recovery
- T1082 System Information Discovery
- T1036 Masquerading
- T1106 Native API
- T1027 Obfuscated Files or Information
- T1057 Process Discovery
- T1055 Process Injection
- T1021 Remote Services
- T1053 Scheduled Task/Job
- T1489 Service Stop
- T1016 System Network Configuration Discovery
- T1078 Valid Accounts
- T1003 OS Credential Dumping
- T1566 Phishing
- T1133 External Remote Services
- T1568 Dynamic Resolution
- T1041 Exfiltration Over C2 Channel

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Ryuk Pre-Encryption Service Stop + Ransom Note Drop + Anchor_DNS C2 Beacon** (`TL-2026-1192-SPL-003`)

Detects the documented late-stage Ryuk kill chain: net.exe service-stop sequences against backup/security/database services, the 'RyukReadMe' ransom-note artifact drop, and Anchor_DNS-style outbound queries to legitimate IP-lookup services used for C2 connectivity checks.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1489, T1490, T1486, T1568, T1041
- **Data sources:** sysmon, windows_security, dns_logs
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 Image="*\\net.exe" (CommandLine="*stop audioendpointbuilder*" OR CommandLine="*stop samss*" OR CommandLine="*stop MSSQL$*")
| eval technique="T1489"
| table _time, ComputerName, User, CommandLine, technique
| append
    [ search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11 TargetFilename="*RyukReadMe*"
      | eval technique="T1486,T1490" | table _time, ComputerName, Image, TargetFilename, technique ]
| append
    [ search index=network sourcetype="dns" (query="ipecho.net" OR query="api.ipify.org" OR query="checkip.amazonaws.com" OR query="icanhazip.com" OR query="ipinfo.io") NOT (process_name="chrome.exe" OR process_name="msedge.exe" OR process_name="firefox.exe")
      | eval technique="T1568,T1041" | table _time, ComputerName, query, process_name, technique ]
| sort - _time
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "net.exe" and ProcessCommandLine has_any ("stop audioendpointbuilder","stop samss","stop MSSQL$")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine
| union (
    DeviceFileEvents
    | where Timestamp > ago(24h)
    | where FileName has "RyukReadMe"
    | project Timestamp, DeviceName, InitiatingProcessFileName, FileName
)
| union (
    DeviceNetworkEvents
    | where Timestamp > ago(24h)
    | where RemoteUrl has_any ("ipecho.net","api.ipify.org","checkip.amazonaws.com","icanhazip.com","ipinfo.io")
    | where InitiatingProcessFileName !in~ ("chrome.exe","msedge.exe","firefox.exe")
    | project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl
)
```

### Sigma

```yaml
title: Ryuk Service-Stop, RyukReadMe Drop, and Anchor_DNS C2 Beacon
id: 8f2c1a90-1192-4003-9a01-000000000003
status: experimental
description: Detects the combined late-stage Ryuk footprint - net.exe service-stop against backup/security/database services, the RyukReadMe ransom-note artifact, and Anchor_DNS-style IP-lookup connectivity checks preceding/accompanying encryption.
references:
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-302a
    - https://www.huntress.com/threat-library/threat-actors/ransomware-group-ryuk
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-10
tags:
    - attack.impact
    - attack.t1489
    - attack.t1490
    - attack.t1486
    - attack.command_and_control
    - attack.t1568
    - attack.exfiltration
    - attack.t1041
    - attack.tool.trickbot
logsource:
    product: windows
    category: process_creation
detection:
    service_stop:
        Image|endswith: '\\net.exe'
        CommandLine|contains:
            - 'stop audioendpointbuilder'
            - 'stop samss'
            - 'stop MSSQL$'
    ransom_note:
        TargetFilename|contains: 'RyukReadMe'
    condition: service_stop or ransom_note
falsepositives:
    - Scheduled maintenance windows that legitimately stop the named services
level: critical
```

**Known false positives:**

- Scheduled maintenance windows that legitimately stop the named services
- Browser processes performing normal external-IP checks

**Tuning notes:** Alert immediately (do not batch) on the RyukReadMe filename match; correlate the service-stop sequence within a 5-minute window per host to reduce false positives from unrelated single-service restarts.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- External Remote Services & Phishing Loader Execution (Sentinel) (locked: unlock with TL Creds)
- Cobalt Strike Beaconing + SMB Admin-Share Lateral Movement (Sentinel) (locked: unlock with TL Creds)
- Anchor_DNS IP-Lookup Beacon + DNS Tunneling C2 Detection (Sentinel) (locked: unlock with TL Creds)
- Spearphishing Attachment Loader Chain (TrickBot/BazarLoader/Emotet) (locked: unlock with TL Creds)
- Access Token Manipulation & Boot/Logon Autostart Persistence (Ryuk Post-Exploitation) (locked: unlock with TL Creds)
- Ryuk Mass File Rename / Inhibit-System-Recovery (Shadow-Copy Deletion) Prior to Encryption (locked: unlock with TL Creds)
- Ryuk Initial Access — Phishing Loader Spawn (TrickBot/BazarLoader/Emotet) & External Remote Service Logon (locked: unlock with TL Creds)
- Ryuk Post-Exploitation — LSASS Credential Access & Valid-Account Reuse via WMI/Scheduled Task (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 20)

Defanged, TLP:CLEAR.

- Domain: `ipecho[.]net`
- Domain: `api[.]ipify[.]org`
- Domain: `checkip[.]amazonaws[.]com`

Full set of 20 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Armenian national pleads guilty in Ryuk ransomware case](https://cyberscoop.com/karen-vardanyan-armenian-ryuk-ransomware-guilty/)
- [District of Oregon | Armenian National Extradited to the United States Pleads Guilty to Ransomware Extortion Conspiracy](https://www.justice.gov/usao-or/pr/armenian-national-extradited-united-states-pleads-guilty-ransomware-extortion-conspiracy)
- [Ryuk operator pleads guilty; Blackcat/AlphV conspirator gets nearly 6-year sentence](https://therecord.media/ryuk-operator-pleads-guilty-alphv-conspirator-sentenced)
- [Ryuk ransomware operator extradited to US, faces five years in federal prison](https://cyberscoop.com/karen-vardanyan-ryuk-ransomware-extradited/)
- [Ryuk Ransomware Indictments: U.S. Charges Armenian and Ukrainian Nationals in Global Ransomware](https://therealistjuggernaut.com/2025/07/17/ryuk-ransomware-indictments-u-s-charges-armenian-and-ukrainian-nationals-in-global-ransomware/)
- [Armenian National Extradited to the United States Faces Federal Charges for Ransomware Extortion Conspiracy](https://databreaches.net/2025/07/16/armenian-national-extradited-to-the-united-states-faces-federal-charges-for-ransomware-extortion-conspiracy/)
- [Ransomware Activity Targeting the Healthcare and Public Health Sector (AA20-302A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-302a)
- [Ryuk, Software S0446 | MITRE ATT&CK](https://attack.mitre.org/software/S0446/)
- [Threat Assessment: Ryuk Ransomware](https://unit42.paloaltonetworks.com/ryuk-ransomware/)
- [Ryuk Ransomware Threat Actor Profile - Big Game Hunting TTPs](https://www.huntress.com/threat-library/threat-actors/ransomware-group-ryuk)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1192