Vardanyan was a core member of the Ryuk gang, prosecutors said, and personally launched several ransomware attacks. He extorted more than $1 million from victims before being placed on an international wanted list by the FBI. The group launched over 2,400 attacks worldwide, including on state and local municipalities, severely disrupting their operations.

Ryuk was first detected in 2018 and has been linked to Russian cybercriminals. The malware was heavily targeted at hospitals during the COVID-19 pandemic, with one attack on Universal Health Services costing the company $67 million. US officials have previously taken down Ryuk’s money laundering operations.

Vardanyan was likely a ransomware affiliate or initial access provider rather than part of the malware development team. Several other members of the group have been identified and arrested over the last three years, including another Armenian national and two Ukrainians. A Russian man was also sentenced in 2023 for laundering funds for the group.