Ryuk Operator Vardanyan Pleads Guilty in Oregon; AlphV Negotiator Martino Gets 70 Months
U.S. courts secured guilty pleas and a 70-month sentence against a Ryuk deployer and AlphV negotiator, exposing how insider roles and extradition routes enable accountability. Evidence from pleas links Ryuk to prior Conti operations while highlighting reactive controls at affected firms. Trend indicates continued focus on accessible mid-level actors rather than core leadership.
Vardanyan, extradited from Ukraine in June 2025 after his Kyiv arrest, admitted accessing networks to install Ryuk, which first appeared in August 2018 and was linked by researchers to Trickbot and Conti infrastructure. Court filings name co-conspirators Levon Avetisyan, Oleg Lyulyava, and Andrii Prykhodchenko, with only Avetisyan confirmed in French custody. The plea includes $1.1 million restitution tied to one confirmed payment.
Martino's 70-month sentence stems from his April 2023 role feeding BlackCat operators confidential client negotiation data while employed at DigitalMint. Two colleagues, Ryan Goldberg of Sygnia and Kevin Martin of DigitalMint, received four-year terms in May after similar guilty pleas. DigitalMint responded with mandatory cloud-audited negotiation platforms and founder-level oversight, a direct reaction to insider betrayal rather than external detection.
These cases mark the first successful U.S. prosecutions of both a Ryuk deployer and a ransomware negotiator turned facilitator. Extradition cooperation from Ukraine and France contrasts with the continued freedom of core Conti-linked actors, suggesting enforcement prioritizes accessible mid-tier targets over leadership. The pattern reveals negotiator firms as persistent weak points once logging mandates are imposed post-incident.
Next developments hinge on whether the remaining three Ryuk defendants are detained before Vardanyan's September sentencing; sustained pressure on negotiator roles may force further operational compartmentalization across groups.
DOJ: At least one additional Ryuk-linked extradition from Eastern Europe completed before Vardanyan sentencing on 22 September 2025.
Sources (3)
- [1]U.S. Department of Justice Press Release(https://www.justice.gov/usao-or/pr/armenian-national-pleads-guilty-ryuk-ransomware-conspiracy)
- [2]The Record Coverage(https://therecord.media/ryuk-operator-pleads-guilty-alphv-conspirator-sentenced)
- [3]Recorded Future Conti Infrastructure Mapping(https://www.recordedfuture.com/conti-ransomware-analysis/)