Armenian extradited to the U.S. faces federal charges in Oregon for ransomware extortion conspiracy

PORTLAND, Ore. (KTVZ) —An Armenian national extradited from Ukraine to the United States faces federal charges for his role in Ryuk ransomware attacks and extortion conspiracy targeting companies throughout the U.S., including a technology company operating in Oregon.

Karen Serobovich Vardanyan, 33, an Armenian national, has been charged with conspiracy, fraud in connection with computers, and extortion in connection with computers. Vardanyan was extradited from Ukraine to the United States on June 18, federal prosecutors said in Wednesday’s announcement, which continues in full below.

Levon Georgiyovych Avetisyan, 45, an Armenian national, has been charged with conspiracy, fraud in connection with computers, and extortion in connection with computers. Avetisyan is the subject of a United States extradition request in France.

Oleg Nikolayevich Lyulyava, 53, and Andrii Leonydovich Prykhodchenko, 53, both Ukrainian nationals, have been charged with conspiracy, fraud in connection with computers, and extortion in connection with computers. Lyulyava and Prykhodchenko are not in custody.

According to court documents, between March 2019 and September 2020, Vardanyan and co-conspirators are alleged to have illegally accessed computer networks of victim companies to deploy Ryuk ransomware on hundreds of compromised servers and workstations.

Ryuk ransomware is a type of malicious software designed to encrypt data on a victim’s computer or network and prevents the victim from accessing the encrypted files until a ransom is paid.

Ryuk has been used to target thousands of victims worldwide across a variety of sectors, including private industry, state and local municipalities, local school districts, critical infrastructure, and hospitals and other healthcare services and providers. Ryuk attacks have severely disrupted these entities’ abilities to function by restricting access to data and impacting communications.

As part of the scheme, ransom payments were extorted from victim companies in exchange for decryption keys to regain access to their data. A ransom note was placed on the computer systems demanding ransom payments in Bitcoin, a form of cryptocurrency, and provided an email address that victims could use to communicate with the cybercriminals.

Vardanyan and co-conspirators are alleged to have received approximately 1,610 bitcoins in ransom payments from the victim companies, which were valued at over $15 million at the time of payment.

Vardanyan made his first appearance in federal court June 20 before a U.S. Magistrate Judge. He was arraigned, pleaded not guilty, and ordered detained pending a seven-day jury trial scheduled to begin on August 26.

If convicted, Vardanyan faces a maximum sentence of five years in federal prison, three years’ supervised release, and a fine of $250,000 for each count.

The case is being investigated by the FBI. It is being prosecuted by Katherine A. Rykken, Assistant U.S. Attorney for the District of Oregon.