Armenian man extradited after ransomware attack targeting Oregon tech company

PORTLAND, Ore. (KOIN) – An Armenian man was extradited from Ukraine to the United States for his alleged role in ransomware attacks against companies across the country, including an attack against an Oregon technology company.

On Wednesday, the U.S. Attorney’s Office for the District of Oregon announced 33-year-old Karen Serobovich Vardanyan was charged with conspiracy, fraud in connection with computers and extortion in connection with computers.

The charges come as Vardanyan was extradited from Ukraine to the United States on June 18, officials said.

Between March 2019 and September 2020, Vardanyan and his co-conspirators allegedly illegally accessed computer networks to deploy Ryuk ransomware against hundreds of compromised servers and workstations, according to court documents.

Officials with the U.S. Attorney’s Office explained that Ryuk ransomware is a type of malicious software that encrypts data on a victim’s computer or network and withholds the data from the victim until a ransom is paid. Ryuk ransomware has been used to target thousands of victims around the world, including those in the private industry, school districts, hospitals and local municipalities.

As part of the scheme, ransom payments were extorted from the victim companies in exchange for decryption keys to regain access to their data, the U.S. Attorney’s Office for the District of Oregon said.

Ransom notes were also placed on computer systems demanding Bitcoin payments and provided an email address for the victims to communicate with the cybercriminals.

Authorities said Vardanyan and his co-conspirators allegedly received about 1,620 bitcoins in ransom payments from the victim companies – which was valued at over $15 million at the time of payment.

Vardanyan made his first federal court appearance June 20 and pleaded not guilty to his charges. Officials said he was ordered detained pending a seven-day jury trial scheduled to begin August 26.

If convicted, Vardanyan faces a maximum five-year sentence in federal prison, three years’ supervised release and a $250,000 fine for each count.

In connection to the scheme, authorities said 45-year-old Levon Georgiyovych Avetisyan, who is also an Armenian national, faces similar charges and an extradition request in France.

Additionally, Oleg Nikolayevich Lyulyava and Andrii Leonydovich Prykhodchenko – both 53-year-old Ukraine nationals – have been charged with conspiracy, fraud and extortion, officials said, noting both are not in custody.

The case is under investigation by the Federal Bureau of Investigation and is being prosecuted by Katherine A. Rykken, assistant U.S. Attorney for the District of Oregon.