Ryuk operator pleads guilty; Blackcat/AlphV conspirator gets nearly 6-year sentence

U.S. prosecutors announced two milestones this week in their cases against major ransomware groups.

Karen Serobovich Vardanyan, a 34-year-old Armenian national, pleaded guilty Wednesday in an Oregon federal court to conspiracy and computer fraud. For about six months beginning in November 2019, he accessed companies’ computer networks to deploy Ryuk ransomware, prosecutors said.

Angelo Martino, 41, of Land O’Lakes, Florida, received a 70-month federal prison sentence in a Florida court on Thursday for helping the Blackcat/AlphV gang extort multiple victims beginning in April 2023. Martino famously used his experience as a ransomware negotiator to aid the cybercriminals.

Ryuk insider

Vardanyan was extradited from Ukraine to the U.S. in June 2025 after his arrest in Kyiv in April. He faces up to 15 years in prison and as much as $500,000 in fines, and he has agreed to pay more than $1.1 million in restitution. Sentencing is scheduled for September 22.

“Vardanyan worked with his co-conspirators to attack a company in Michigan that paid 200 bitcoin or over $1.1 million at the time of payment to restore access to their network,” prosecutors said. “They also attacked a company in Wilsonville, Oregon, and in February 2020 attacked a school in Texas.”

Ryuk was first detected in August 2018, when it began attacking large organizations with demands for high ransom payments. Law enforcement agencies and cybersecurity researchers have connected it with other major cybercrime operations such as Conti and Trickbot.

International authorities have targeted Ryuk for years, successfully prosecuting one of its money launderers and sanctioning other alleged members.

Vardanyan’s case is connected to others still being pursued by U.S. prosecutors. Armenian national Levon Georgiyovych Avetisyan has been charged with conspiracy, fraud and extortion. Ukrainian nationals Oleg Nikolayevich Lyulyava and Andrii Leonydovich Prykhodchenko face the same charges. Prosecutors said last year that Avetisyan was in custody in France, and Lyulyava and Prykhodchenko were not in custody.

Ransom negotiator turned cybercrook

Martino surrendered himself to U.S. Marshals in March and pleaded guilty in April to an extortion charge.

Prosecutors said Martino “was paid by BlackCat attackers to provide confidential information about the negotiating position and strategy of his employer’s clients and enable the ransomware actors to maximize the ransoms paid by the victims.”

Two other men connected to the same case pleaded — Ryan Goldberg and Kevin Martin — pleaded guilty to extortion charges earlier this year and were given four-year prison sentences in May.

Martin and Martino were ransomware negotiators for DigitalMint. Goldberg worked for incident response firm Sygnia.

DigitalMint has instituted several new controls that mandate all negotiations be conducted over cloud-based platforms that can be audited and logged. One of the company’s founders is personally overseeing all negotiations.