Ryuk ransomware operator extradited to US, faces five years in federal prison | CyberScoop<\/title> <meta name=\"description\" content=\"Karen Vardanyan and his co-conspirators allegedly deployed ransomware on hundreds of machines in 2019 and 2020, extorting more than $15 million from victims at the time.\"> <link rel=\"canonical\" href=\"https:\/\/cyberscoop.com\/karen-vardanyan-ryuk-ransomware-extradited\/\"> <meta property=\"og:locale\" content=\"en_US\"> <meta property=\"og:type\" content=\"article\"> <meta property=\"og:title\" content=\"Ryuk ransomware operator extradited to US, faces five years in federal prison\"> <meta property=\"og:description\" content=\"Karen Vardanyan and his co-conspirators allegedly deployed ransomware on hundreds of machines in 2019 and 2020, extorting more than $15 million from victims at the time.\"> <meta property=\"og:url\" content=\"https:\/\/cyberscoop.com\/karen-vardanyan-ryuk-ransomware-extradited\/\"> <meta property=\"og:site_name\" content=\"CyberScoop\"> <meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/cyberscoop\/\"> <meta property=\"article:published_time\" content=\"2025-07-16T21:24:34+00:00\"> <meta property=\"article:modified_time\" content=\"2025-07-16T21:24:37+00:00\"> <meta property=\"og:image\" content=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/ryuk-ransomware-operator-extradited-to-us-faces-five-years-in-federal-prison-5.jpg\"> <meta property=\"og:image:width\" content=\"1920\"> <meta property=\"og:image:height\" content=\"1280\"> <meta property=\"og:image:type\" content=\"image\/jpeg\"> <meta name=\"author\" content=\"Matt Kapko\"> <meta name=\"twitter:card\" content=\"summary_large_image\"> <meta name=\"twitter:creator\" content=\"@CyberScoopNews\"> <meta name=\"twitter:site\" content=\"@CyberScoopNews\">  <link rel=\"dns-prefetch\" href=\"\/\/securepubads.g.doubleclick.net\">\n<link rel=\"dns-prefetch\" href=\"\/\/use.typekit.net\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Feed\" href=\"https:\/\/cyberscoop.com\/feed\/\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Comments Feed\" href=\"https:\/\/cyberscoop.com\/comments\/feed\/\"> <link rel=\"stylesheet\" id=\"all-css-2\" href=\"https:\/\/cyberscoop.com\/wp-includes\/css\/dist\/block-library\/style.min.css?m=1752617955g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-6\" href=\"https:\/\/cyberscoop.com\/wp-content\/mu-plugins\/search\/elasticpress\/dist\/css\/related-posts-block-styles.min.css?m=1752617143g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-8\" href=\"https:\/\/cyberscoop.com\/wp-content\/themes\/scoopnewsgroup\/dist\/css\/frontend.css?m=1752075323g\" type=\"text\/css\" media=\"all\">\n<link rel=\"stylesheet\" id=\"typekit-css\" href=\"https:\/\/use.typekit.net\/itk2qbh.css?ver=13897d660a0ac2c9c7d1\" media=\"all\"> <link rel=\"https:\/\/api.w.org\/\" href=\"https:\/\/cyberscoop.com\/wp-json\/\"><link rel=\"alternate\" title=\"JSON\" type=\"application\/json\" href=\"https:\/\/cyberscoop.com\/wp-json\/wp\/v2\/posts\/85220\"><link rel=\"EditURI\" type=\"application\/rsd+xml\" title=\"RSD\" href=\"https:\/\/cyberscoop.com\/xmlrpc.php?rsd\">\n<meta name=\"generator\" content=\"WordPress 6.8.2\">\n<link rel=\"shortlink\" href=\"https:\/\/cyberscoop.com\/?p=85220\">\n<link rel=\"alternate\" title=\"oEmbed (JSON)\" type=\"application\/json+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Fkaren-vardanyan-ryuk-ransomware-extradited%2F\">\n<link rel=\"alternate\" title=\"oEmbed (XML)\" type=\"text\/xml+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Fkaren-vardanyan-ryuk-ransomware-extradited%2F&format=xml\">   <link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=32\" sizes=\"32x32\">\n<link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=192\" sizes=\"192x192\">\n<link rel=\"apple-touch-icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=180\">\n<meta name=\"msapplication-TileImage\" content=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=270\"> <\/head><body class=\"wp-singular post-template-default single single-post postid-85220 single-format-standard wp-theme-scoopnewsgroup wp-child-theme-cyberscoop\" id=\"readabilityBody\"> <a href=\"https:\/\/cyberscoop.com\/karen-vardanyan-ryuk-ransomware-extradited\/#main\" class=\"skip-to-content-link visually-hidden-focusable\">Skip to main content<\/a> <\/p>\n<div class=\"ad ad--top ad--top-desktop\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p> <main id=\"main\" role=\"main\" tabindex=\"-1\"> <\/p>\n<div class=\"ad ad--top ad--top-mobile\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<section id=\"stickybar\" class=\"stickybar stickybar--event js-stickybar\">\n<div class=\"stickybar__details\" readability=\"4.9180327868852\">\n<div class=\"stickybar__info js-sticky-bar-content\" readability=\"32\">\n<p>Voting is open for the 2025 CyberScoop 50 awards!<\/p>\n<\/div>\n<p> <a class=\"stickybar__link button button-tertiary\" href=\"https:\/\/cyberscoop.com\/cyberscoop50\/\">Click here!<\/a> <\/div>\n<p> <button class=\"stickybar__close js-stickybar-close\" aria-controls=\"stickybar\"> <svg class=\"icon icon--close\" width=\"21\" height=\"22\" viewBox=\"0 0 21 22\" fill=\"none\"><path d=\"m.822.518-.805.805L9.695 11 .017 20.678l.805.805 9.678-9.678 9.677 9.678.806-.805L11.305 11l9.678-9.677-.806-.805-9.677 9.677L.822.518Z\" fill=\"currentColor\" \/><\/svg> <span class=\"visually-hidden\">Close<\/span> <\/button> <\/section>\n<article class=\"single-article content\">\n<div class=\"single-article__container js-single-article-content\">\n<header class=\"single-article__header \" readability=\"26.105960264901\">\n<div class=\"single-article__header-content\" readability=\"35.318181818182\">\n<ul class=\"single-article__eyebrow\">\n<li class=\"single-article__category\"> <a class=\"single-article__category-link\" href=\"https:\/\/cyberscoop.com\/karen-vardanyan-ryuk-ransomware-extradited\/\"> <span>Ransomware<\/span> <\/a> <\/li>\n<\/ul>\n<p> Karen Vardanyan and his co-conspirators allegedly deployed ransomware on hundreds of machines in 2019 and 2020, extorting more than $15 million from victims at the time. <\/p>\n<p>  <br \/>\n<audio id=\"audio-player\" src=\"https:\/\/wp-tts-cdn.api.scpnewsgrp.com\/cyberscoop\/85220\/english.openai.mp3\"><\/audio> <\/p>\n<div readability=\"11\">\n<div>\n<p>Listen to this article<\/p>\n<p>  <\/p>\n<p>0:00<\/p>\n<\/p><\/div>\n<p>  <\/p>\n<p> <span id=\"tts-tooltip\">Learn more.<\/span> <span> This feature uses an automated voice, which may result in occasional errors in pronunciation, tone, or sentiment. <\/span> <\/p>\n<\/div>\n<p>  <\/div>\n<div class=\"single-article__cover-wrap\">\n<figure class=\"single-article__cover\"> <img data-recalc-dims=\"1\" fetchpriority=\"high\" width=\"640\" height=\"426\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/ryuk-ransomware-operator-extradited-to-us-faces-five-years-in-federal-prison.jpg?resize=640%2C426&ssl=1\" class=\"single-article__cover-image wp-post-image\" alt decoding=\"async\" fetchpriority=\"high\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/ryuk-ransomware-operator-extradited-to-us-faces-five-years-in-federal-prison-5.jpg 1920w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/ryuk-ransomware-operator-extradited-to-us-faces-five-years-in-federal-prison-5.jpg?resize=300,200 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/ryuk-ransomware-operator-extradited-to-us-faces-five-years-in-federal-prison-5.jpg?resize=768,512 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/ryuk-ransomware-operator-extradited-to-us-faces-five-years-in-federal-prison-5.jpg?resize=1024,683 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/ryuk-ransomware-operator-extradited-to-us-faces-five-years-in-federal-prison-5.jpg?resize=1536,1024 1536w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/ryuk-ransomware-operator-extradited-to-us-faces-five-years-in-federal-prison-5.jpg?resize=600,400 600w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/ryuk-ransomware-operator-extradited-to-us-faces-five-years-in-federal-prison-5.jpg?resize=252,168 252w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/ryuk-ransomware-operator-extradited-to-us-faces-five-years-in-federal-prison-5.jpg?resize=506,337 506w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/ryuk-ransomware-operator-extradited-to-us-faces-five-years-in-federal-prison-5.jpg?resize=1013,675 1013w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/ryuk-ransomware-operator-extradited-to-us-faces-five-years-in-federal-prison-5.jpg?resize=1265,843 1265w\" sizes=\"(max-width: 1013px) 100vw, 1013px\"><figcaption> The Department of Justice building is seen in Washington, DC, on August 9, 2022. (Photo by Stefani Reynolds \/ AFP) (Photo by STEFANI REYNOLDS\/AFP via Getty Images) <\/figcaption><\/figure>\n<\/p><\/div>\n<\/header>\n<div class=\"single-article__content\">\n<div class=\"single-article__content-inner has-drop-cap\"> <html readability=\"22.391886792453\"><body readability=\"47.01867816092\"><\/p>\n<p>An Armenian national is in federal custody and faces charges stemming from their alleged involvement in a spree of attacks in 2019 and 2020 involving Ryuk ransomware, the Justice Department said Wednesday.<\/p>\n<p>Karen Serobovich Vardanyan, 33, was <a href=\"https:\/\/www.justice.gov\/usao-or\/pr\/armenian-national-extradited-united-states-faces-federal-charges-ransomware-extortion\">extradited from Ukraine to the United States<\/a> on June 18 and pleaded not guilty to the charges in his first appearance in federal court June 20. Vardanyan is awaiting a seven-day jury trial scheduled to begin Aug. 26.<\/p>\n<p>Prosecutors charged Vardanyan with conspiracy, fraud in connection with computers and extortion in connection with computers. He faces a maximum of five years in federal prison and a fine of $250,000 for each charge.<\/p>\n<p>Vardanyan and his co-conspirators \u2014 a pair of 53-year-old Ukrainian nationals, Oleg Nikolayevich Lyulyava and Andrii Leonydovich Prykhodchenko, and 45-year-old Armenian national Levon Georgiyovych Avetisyan \u2014 are accused of illegally accessing computer networks to deploy Ryuk ransomware on hundreds of compromised servers and workstations between March 2019 and September 2020.<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>Avetisyan is awaiting a U.S. extradition request in France, while Lyulyava and Prykhodchenko remain at large. <\/p>\n<p>Ryuk ransomware was prevalent in 2019 and 2020, infecting thousands of victims globally across the private sector, state and local municipalities, local school districts and critical infrastructure, according to authorities. This includes a wave of attacks on U.S. hospitals and a technology company based in Oregon, where federal prosecutors are trying their case against Vardanyan. <\/p>\n<p>Victims of Ryuk ransomware attacks include <a href=\"https:\/\/cyberscoop.com\/health-care-ransomware-coronavirus-ryuk\/\">Hollywood Presbyterian Medical Center<\/a>, <a href=\"https:\/\/cyberscoop.com\/universal-health-services-ransomware-cost-ryuk\/\">Universal Health Services<\/a>, <a href=\"https:\/\/cyberscoop.com\/ryuk-ransomware-ewa-dod-contractor\/\">Electronic Warfare Associates<\/a>, a <a href=\"https:\/\/cyberscoop.com\/ransomware-hits-onwasa-computer-network-north-carolina-water-utility\/\">North Carolina water utility<\/a> and multiple U.S. newspapers.<\/p>\n<p>Ryuk ransomware operators extorted victim companies by demanding ransom payments in Bitcoin in exchange for decryption keys. Justice Department officials said Vardanyan and his co-conspirators received about 1,160 bitcoins \u2014 valued at more than $15 million at the time \u2014 in ransom payments from victim companies.<\/p>\n<p><\/body> <\/p>\n<footer class=\"single-article__footer\" readability=\"3.216577540107\">\n<div class=\"author-card\" readability=\"14\">\n<div class=\"author-card__avatar\">\n<figure class=\"author-card__image-wrap\"> <img data-recalc-dims=\"1\" decoding=\"async\" class=\"author-card__image\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/ryuk-ransomware-operator-extradited-to-us-faces-five-years-in-federal-prison-1.jpg?w=640&ssl=1\" alt=\"Matt Kapko\"> <\/figure>\n<\/p><\/div>\n<p><h4 class=\"author-card__name\">Written by Matt Kapko<\/h4>\n<p> Matt Kapko is a reporter at CyberScoop. His beat includes cybercrime, ransomware, software defects and vulnerability (mis)management. The lifelong Californian started his journalism career in 2001 with previous stops at Cybersecurity Dive, CIO, SDxCentral and RCR Wireless News. Matt has a degree in journalism and history from Humboldt State University. <\/p>\n<\/p><\/div>\n<div class=\"single-article__tags-container\">\n<h4 class=\"single-article__tags-title\">In This Story<\/h4>\n<\/p><\/div>\n<\/footer>\n<p> <\/html><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"single-article__ads js-single-article-sidebar\">\n<div class=\"ad ad--sidebar js-single-article-sidebar-5 ad--rightrail_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-4 ad--rightrail_2 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-3 ad--rightrail_3 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div><\/div>\n<\/article>\n<div class=\"popular-stories popular-stories--single-post\">\n<div class=\"popular-stories__container\">\n<h2 class=\"popular-stories__title\"> More Scoops <\/h2>\n<div class=\"popular-stories__stories\">\n<div class=\"popular-stories__cards\">\n<article class=\"post-item post-item--popular-stories-cards \" readability=\"21.304109589041\">\n<figure class=\"post-item__thumbnail\"> <a class=\"post-item__thumbnail-link\" href=\"https:\/\/cyberscoop.com\/black-kingdom-ransomware-indictment-doj\/\" tabindex=\"-1\"> <img data-recalc-dims=\"1\" loading=\"lazy\" width=\"506\" height=\"337\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/ryuk-ransomware-operator-extradited-to-us-faces-five-years-in-federal-prison-2.jpg?resize=506%2C337&ssl=1\" class=\"attachment-ratio-16-9-md size-ratio-16-9-md wp-post-image\" alt decoding=\"async\" loading=\"lazy\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/ryuk-ransomware-operator-extradited-to-us-faces-five-years-in-federal-prison-6.jpg 1920w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/ryuk-ransomware-operator-extradited-to-us-faces-five-years-in-federal-prison-6.jpg?resize=300,200 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/ryuk-ransomware-operator-extradited-to-us-faces-five-years-in-federal-prison-6.jpg?resize=768,512 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/ryuk-ransomware-operator-extradited-to-us-faces-five-years-in-federal-prison-6.jpg?resize=1024,683 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/ryuk-ransomware-operator-extradited-to-us-faces-five-years-in-federal-prison-6.jpg?resize=1536,1024 1536w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/ryuk-ransomware-operator-extradited-to-us-faces-five-years-in-federal-prison-6.jpg?resize=600,400 600w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/ryuk-ransomware-operator-extradited-to-us-faces-five-years-in-federal-prison-6.jpg?resize=252,168 252w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/ryuk-ransomware-operator-extradited-to-us-faces-five-years-in-federal-prison-6.jpg?resize=506,337 506w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/ryuk-ransomware-operator-extradited-to-us-faces-five-years-in-federal-prison-6.jpg?resize=1013,675 1013w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/ryuk-ransomware-operator-extradited-to-us-faces-five-years-in-federal-prison-6.jpg?resize=1265,843 1265w\" sizes=\"auto, (max-width: 506px) 100vw, 506px\"> <\/a><figcaption class=\"screen-reader-text\"> The Department of Justice (DOJ) in Washington, DC, on February 5, 2022. (Photo by STEFANI REYNOLDS\/AFP via Getty Images) <\/figcaption><\/figure>\n<header class=\"post-item__meta\" readability=\"2.7377049180328\">\n<h3 class=\"post-item__title\"> <a class=\"post-item__title-link\" href=\"https:\/\/cyberscoop.com\/black-kingdom-ransomware-indictment-doj\/\"> Federal prosecutors indict alleged head of Black Kingdom ransomware <\/a> <\/h3>\n<p> A man believed to be living in Yemen is accused of developing the ransomware and infecting about 1,500 computer systems in the U.S. and elsewhere between March\u2026 <\/p>\n<div class=\"post-item__byline\"> <span class=\"post-item__author\"> <span>By <\/span> <a class=\"post-item__author-link\" href=\"https:\/\/cyberscoop.com\/author\/matt-kapko\/\"> Matt Kapko <\/a> <\/span> <\/div>\n<p> <\/header>\n<p> <\/article>\n<article class=\"post-item post-item--popular-stories-cards \">\n<figure class=\"post-item__thumbnail\"> <a class=\"post-item__thumbnail-link\" href=\"https:\/\/cyberscoop.com\/nefilim-ransomware-artem-stryzhak-extradited\/\" tabindex=\"-1\"> <img data-recalc-dims=\"1\" loading=\"lazy\" width=\"252\" height=\"168\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/ryuk-ransomware-operator-extradited-to-us-faces-five-years-in-federal-prison-3.jpg?resize=252%2C168&ssl=1\" class=\"attachment-ratio-16-9-sm size-ratio-16-9-sm wp-post-image\" alt decoding=\"async\" loading=\"lazy\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/ryuk-ransomware-operator-extradited-to-us-faces-five-years-in-federal-prison-7.jpg 1920w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/ryuk-ransomware-operator-extradited-to-us-faces-five-years-in-federal-prison-7.jpg?resize=300,200 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/ryuk-ransomware-operator-extradited-to-us-faces-five-years-in-federal-prison-7.jpg?resize=768,512 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/ryuk-ransomware-operator-extradited-to-us-faces-five-years-in-federal-prison-7.jpg?resize=1024,683 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/ryuk-ransomware-operator-extradited-to-us-faces-five-years-in-federal-prison-7.jpg?resize=1536,1024 1536w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/ryuk-ransomware-operator-extradited-to-us-faces-five-years-in-federal-prison-7.jpg?resize=600,400 600w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/ryuk-ransomware-operator-extradited-to-us-faces-five-years-in-federal-prison-7.jpg?resize=252,168 252w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/ryuk-ransomware-operator-extradited-to-us-faces-five-years-in-federal-prison-7.jpg?resize=506,337 506w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/ryuk-ransomware-operator-extradited-to-us-faces-five-years-in-federal-prison-7.jpg?resize=1013,675 1013w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/ryuk-ransomware-operator-extradited-to-us-faces-five-years-in-federal-prison-7.jpg?resize=1265,843 1265w\" sizes=\"auto, (max-width: 252px) 100vw, 252px\"> <\/a><figcaption class=\"screen-reader-text\"> The Department of Justice building in Washington, DC, on February 9, 2022. (Photo by STEFANI REYNOLDS\/AFP via Getty Images) <\/figcaption><\/figure>\n<header class=\"post-item__meta\">\n<h3 class=\"post-item__title\"> <a class=\"post-item__title-link\" href=\"https:\/\/cyberscoop.com\/nefilim-ransomware-artem-stryzhak-extradited\/\"> Ukrainian extradited to US for alleged Nefilim ransomware attack spree <\/a> <\/h3>\n<div class=\"post-item__byline\"> <span class=\"post-item__author\"> <span>By <\/span> <a class=\"post-item__author-link\" href=\"https:\/\/cyberscoop.com\/author\/matt-kapko\/\"> Matt Kapko <\/a> <\/span> <\/div>\n<p> <\/header>\n<p> <\/article>\n<article class=\"post-item post-item--popular-stories-cards \">\n<figure class=\"post-item__thumbnail\"> <a class=\"post-item__thumbnail-link\" href=\"https:\/\/cyberscoop.com\/alleged-russian-phobos-ransomware-administrator-extradited-to-u-s-in-custody\/\" tabindex=\"-1\"> <img data-recalc-dims=\"1\" loading=\"lazy\" width=\"238\" height=\"168\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/ryuk-ransomware-operator-extradited-to-us-faces-five-years-in-federal-prison-4.jpg?resize=238%2C168&ssl=1\" class=\"attachment-ratio-16-9-sm size-ratio-16-9-sm wp-post-image\" alt decoding=\"async\" loading=\"lazy\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/ryuk-ransomware-operator-extradited-to-us-faces-five-years-in-federal-prison-8.jpg 1920w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/ryuk-ransomware-operator-extradited-to-us-faces-five-years-in-federal-prison-8.jpg?resize=300,212 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/ryuk-ransomware-operator-extradited-to-us-faces-five-years-in-federal-prison-8.jpg?resize=768,542 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/ryuk-ransomware-operator-extradited-to-us-faces-five-years-in-federal-prison-8.jpg?resize=1024,723 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/ryuk-ransomware-operator-extradited-to-us-faces-five-years-in-federal-prison-8.jpg?resize=1536,1085 1536w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/ryuk-ransomware-operator-extradited-to-us-faces-five-years-in-federal-prison-8.jpg?resize=600,424 600w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/ryuk-ransomware-operator-extradited-to-us-faces-five-years-in-federal-prison-8.jpg?resize=238,168 238w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/ryuk-ransomware-operator-extradited-to-us-faces-five-years-in-federal-prison-8.jpg?resize=477,337 477w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/ryuk-ransomware-operator-extradited-to-us-faces-five-years-in-federal-prison-8.jpg?resize=956,675 956w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/ryuk-ransomware-operator-extradited-to-us-faces-five-years-in-federal-prison-8.jpg?resize=1194,843 1194w\" sizes=\"auto, (max-width: 238px) 100vw, 238px\"> <\/a><figcaption class=\"screen-reader-text\"> This handout image, obtained August 21, 2008 taken by the High Resolution Stereo Camera on board the ESA\u2019s Mars Express shows the highest-resolution full-disc image yet of the surface of the moon Phobos. (Photo by NASA\/ESA via Getty Images) <\/figcaption><\/figure>\n<header class=\"post-item__meta\">\n<h3 class=\"post-item__title\"> <a class=\"post-item__title-link\" href=\"https:\/\/cyberscoop.com\/alleged-russian-phobos-ransomware-administrator-extradited-to-u-s-in-custody\/\"> Alleged Russian Phobos ransomware administrator extradited to U.S., in custody <\/a> <\/h3>\n<div class=\"post-item__byline\"> <span class=\"post-item__author\"> <span>By <\/span> <a class=\"post-item__author-link\" href=\"https:\/\/cyberscoop.com\/author\/tim-starkscyberscoop-com\/\"> Tim Starks <\/a> <\/span> <\/div>\n<p> <\/header>\n<p> <\/article>\n<\/p><\/div>\n<\/p><\/div>\n<p> <\/div>\n<p>\n<\/div>\n<p> <\/p>\n<section class=\"latest-podcasts\">\n<h2 class=\"latest-podcasts__title\"> Latest Podcasts\t<\/h2>\n<\/section>\n<div class=\"top-categories\">\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Government<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Technology<\/h3>\n<\/p><\/div>\n<\/p><\/div>\n<p> <\/main> <\/p>\n<div class=\"ad ad--bottom \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div id=\"interstitial\" class=\"welcome__container\"> <button id=\"close-modal-1\" class=\"welcome__clickable_area\"><\/button> <\/p>\n<div class=\"welcome__ad_wrapper\">\n<p> <button id=\"close-modal-3\" class=\"welcome__continue-button\">Continue to CyberScoop<\/button> <\/p>\n<\/p><\/div>\n<\/p><\/div>\n<p>   <\/body> <a href=\"https:\/\/cyberscoop.com\/karen-vardanyan-ryuk-ransomware-extradited\/\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Ryuk ransomware operator extradited to US, faces five years in<\/p>\n","protected":false},"author":11,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[4586,413,282,78,338,323,669,117,459,46,4587,4588,288,354],"tags":[4589,415,286,86,341,327,671,119,461,54,4590,4591,294,358],"class_list":["post-7809","post","type-post","status-publish","format-standard","hentry","category-armenia","category-critical-infrastructure","category-cybercrime","category-cybersecurity","category-department-of-justice-doj","category-extortion","category-federal-bureau-of-investigation-fbi","category-government","category-health-care","category-ransomware","category-ryuk","category-ryuk-ransomware","category-threats","category-ukraine","tag-armenia","tag-critical-infrastructure","tag-cybercrime","tag-cybersecurity","tag-department-of-justice-doj","tag-extortion","tag-federal-bureau-of-investigation-fbi","tag-government","tag-health-care","tag-ransomware","tag-ryuk","tag-ryuk-ransomware","tag-threats","tag-ukraine"],"featured_image_urls":{"full":"","thumbnail":"","medium":"","medium_large":"","large":"","1536x1536":"","2048x2048":"","chromenews-featured":"","chromenews-large":"","chromenews-medium":""},"author_info":{"display_name":"Cyber Scoop","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/cyberscoop\/"},"category_info":"<a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/armenia\/\" rel=\"category tag\">Armenia<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/critical-infrastructure\/\" rel=\"category tag\">critical infrastructure<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/cybercrime\/\" rel=\"category tag\">cybercrime<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/cybersecurity\/\" rel=\"category tag\">Cybersecurity<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/department-of-justice-doj\/\" rel=\"category tag\">Department of Justice (DOJ)<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/extortion\/\" rel=\"category tag\">extortion<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/federal-bureau-of-investigation-fbi\/\" rel=\"category tag\">Federal Bureau of Investigation (FBI)<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/government\/\" rel=\"category tag\">Government<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/health-care\/\" rel=\"category tag\">health care<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/ransomware\/\" rel=\"category tag\">ransomware<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/ryuk\/\" rel=\"category tag\">Ryuk<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/ryuk-ransomware\/\" rel=\"category tag\">Ryuk ransomware<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/threats\/\" rel=\"category tag\">Threats<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/ukraine\/\" rel=\"category tag\">Ukraine<\/a>","tag_info":"Ukraine","comment_count":"0","jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/7809","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=7809"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/7809\/revisions"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=7809"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=7809"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=7809"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":7809,"date":"2025-07-16T16:24:34","date_gmt":"2025-07-16T21:24:34","guid":{"rendered":"https:\/\/cyberscoop.com\/?p=85220"},"modified":"2025-07-16T16:24:34","modified_gmt":"2025-07-16T21:24:34","slug":"ryuk-ransomware-operator-extradited-to-us-faces-five-years-in-federal-prison","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2025\/07\/16\/ryuk-ransomware-operator-extradited-to-us-faces-five-years-in-federal-prison\/","title":{"rendered":"Ryuk ransomware operator extradited to US, faces five years in federal prison"},"content":{"rendered":"