Ryuk Ransomware Gang Member Sentenced as Australian Healthcare Attack Link Resurfaces

A US court has sentenced Karen Vardanyan, an Armenian national and member of the Ryuk ransomware gang, to two years in prison plus three years of supervised release. He was also ordered to pay US$1.219 million (about A$1.7 million) in restitution to victims. Vardanyan, known by the aliases Manekeen and Karl Lagerfeld, was arrested in Kyiv and extradited to the US in 2025, pleading guilty to conspiracy and fraud charges after being part of the Ryuk operation since 2019.

Ryuk has a direct connection to Australia: the Australian Cyber Security Centre attributed a 2019 attack on Victoria's healthcare sector to threat actors using Ryuk ransomware, with hospitals in the Gippsland Health Alliance and the South West Alliance of Rural Health both affected. It is not confirmed whether Vardanyan personally took part in those attacks. Ryuk also targeted American hospitals during the Covid-19 pandemic in 2020, alongside the Conti ransomware, according to the US Cybersecurity and Infrastructure Security Agency, and the group is estimated to have extorted at least US$15 million from victims globally. US authorities have named three further alleged Ryuk members: Levon Avetisyan, Oleg Lyulyava and Andrii Prikhodchenko.

The case is a reminder that ransomware groups responsible for attacks on Australian organisations, including critical healthcare services, are being pursued and prosecuted internationally, even years after the fact.