Two ransomware cases hit major milestones in U.S. courts
Federal prosecutors are closing in on the people who built and ran some of the most damaging ransomware operations of the past decade. This week brought two significant developments: a Ryuk operator pleaded guilty in Oregon, and a Florida man who helped the Blackcat/AlphV gang got a 70-month prison sentence.
Karen Serobovich Vardanyan, a 34-year-old Armenian national, admitted to conspiracy and computer fraud charges on Wednesday. For about six months starting in November 2019, he broke into corporate networks to deploy Ryuk ransomware, according to prosecutors.
Separately, Angelo Martino, 41, of Land O’Lakes, Florida, was sentenced to 70 months in federal prison for aiding Blackcat/AlphV extortion efforts beginning in April 2023. Martino’s case stands out because he used his day job as a ransomware negotiator to help the criminals squeeze more money out of victims.
Vardanyan’s Ryuk attacks: a Michigan company paid 200 bitcoin
Vardanyan was extradited from Ukraine to the U.S. in June 2025, after his arrest in Kyiv two months earlier. He now faces up to 15 years in prison and fines up to $500,000. He has also agreed to pay more than $1.1 million in restitution. His sentencing is set for September 22.
Prosecutors detailed some of his alleged attacks. “Vardanyan worked with his co-conspirators to attack a company in Michigan that paid 200 bitcoin or over $1.1 million at the time of payment to restore access to their network,” they said. “They also attacked a company in Wilsonville, Oregon, and in February 2020 attacked a school in Texas.”
Ryuk first appeared in August 2018, targeting large organizations with enormous ransom demands. Law enforcement and cybersecurity researchers have tied it to other major cybercrime operations, including Conti and Trickbot. International authorities have pursued Ryuk for years, successfully prosecuting one of its money launderers and sanctioning other alleged members.
Other Ryuk defendants still being pursued
Vardanyan’s case is part of a broader crackdown. Armenian national Levon Georgiyovych Avetisyan faces conspiracy, fraud, and extortion charges. Ukrainian nationals Oleg Nikolayevich Lyulyava and Andrii Leonydovich Prykhodchenko face the same charges. Prosecutors said last year that Avetisyan was in custody in France, while the two Ukrainians remained at large.
The U.S. Department of Justice has been steadily dismantling the Ryuk ecosystem, which also overlaps with the Trickbot botnet infrastructure. Each guilty plea and arrest chips away at the network’s ability to operate.
Martino: the negotiator who turned against his own clients
Martino surrendered to U.S. Marshals in March and pleaded guilty in April to an extortion charge. His story is a cautionary tale about trust in the cybersecurity industry.
Prosecutors said Martino “was paid by BlackCat attackers to provide confidential information about the negotiating position and strategy of his employer’s clients and enable the ransomware actors to maximize the ransoms paid by the victims.” In other words, he was double-dealing — collecting a salary from a legitimate firm while secretly working for the criminals on the other side of the negotiation table.
Two other men connected to the same case, Ryan Goldberg and Kevin Martin, pleaded guilty to extortion charges earlier this year. Both received four-year prison sentences in May. Martin and Martino were ransomware negotiators for DigitalMint, while Goldberg worked for incident response firm Sygnia.
DigitalMint has since implemented new controls requiring all negotiations to be conducted over cloud-based platforms that can be audited and logged. One of the company’s founders is personally overseeing all negotiations now.
What this means for ransomware enforcement
These cases show that law enforcement is willing to pursue not just the hackers who deploy ransomware, but also the people who enable them — even when those people hold legitimate jobs in the cybersecurity industry. The Martino case, in particular, sends a message to negotiators and incident responders: if you cross the line, you’ll face serious consequences.
For ransomware victims and negotiators, the takeaway is clear. Verify who you’re working with. Check backgrounds. And be aware that the person helping you negotiate could be feeding information to the attackers.
Both cases also highlight the international scope of ransomware investigations. Vardanyan was arrested in Ukraine and extradited to the U.S. Avetisyan is in French custody. The Justice Department is coordinating with allies to chase these suspects across borders.
Sentencing for Vardanyan is scheduled for September 22. Martino’s 70-month sentence is already in place. The fallout from these cases will likely continue as prosecutors pursue the remaining defendants.
