Vardanyan was sentenced to 24 months in the Ryuk ransomware case. Restitution is part of the judgment.

A sentence after a guilty plea is the judgment on the counts admitted. Restitution is part of that judgment, not a new accusation. On Tuesday, Sept. 22, 2026, Karen Serobovich Vardanyan, 35, an Armenian national, was sentenced in federal court in Portland, Oregon, to 24 months in prison, three years of supervised release, and $1,219,106 in restitution. He had pleaded guilty on July 8, 2026, to conspiracy and fraud in connection with computers in the Ryuk ransomware case.

Vardanyan, reported under the online monikers Maneeken and Karl Lagerfeld, was extradited from Ukraine and made his initial appearance in the United States around June 20, 2025. The July 8, 2026 plea is the admission. The Sept. 22 sentence is the judgment on that plea. The government account describes an initial-access role in a conspiracy that deployed Ryuk ransomware from about March 2019 through June 2020 against U.S. companies, schools, and other entities. Victims in that account included a company in Wilsonville, Oregon. Reporting also notes a Michigan company and a Texas school among organizations that were breached. Those descriptions are the case narrative behind the plea. They are not a new charging document filed when the court imposed sentence.

U.S. Attorney Scott E. Bradford announced the sentence for the District of Oregon. The FBI investigated the case. Assistant U.S. Attorney Katherine Rykken prosecuted it. The 24-month prison term, the three years of supervised release, and the $1,219,106 restitution order are one judgment. Supervised release is part of that sentence. Restitution is part of that sentence. Neither is a second case.