Ryuk operator Karen Vardanyan sentenced to 2 years US prison; ACSC tied Ryuk to 2019 Victorian health attacks
iTnews (25 September 2026 05:05 AEST) reports that a US court sentenced Karen Vardanyan (aliases Manekeen / Karl Lagerfeld), an Armenian national extradited from Kyiv in 2025, to two years’ federal prison and about US$1.219 million in restitution after a July 2026 guilty plea to conspiracy and computer fraud tied to Ryuk ransomware operations from 2019. Wire cites US prosecutors that Ryuk took at least US$15 million in extortion; other alleged Ryuk members named in reporting include Levon Avetisyan, Oleg Lyulyava and Andrii Prikhodchenko.
Australia angle: ACSC previously attributed a 2019 Victorian healthcare-sector attack (Gippsland Health Alliance and South West Alliance of Rural Health) to Ryuk operators — iTnews notes it is not clear whether Vardanyan was involved in those AU incidents.
Primary notice URL: US Attorney’s Office District of Oregon press release (fetch blocked from this desk; facts from iTnews wire quoting prosecutors). Distinct from Conti/Ryuk historical KEV material.
- Product
- Ryuk ransomware (historical Conti-era affiliate operations)
- Versions
- n/a (criminal sentence / historical AU healthcare attribution)
- Exploited in Australia?
- yes
- Patch to
- Historical AU health-sector lesson: maintain offline recoverable backups, network segmentation for clinical systems, and tested IR playbooks for ransomware; treat Conti/Ryuk-era TTPs as still relevant for affiliate successors; no product patch for this sentencing story