Ryuk Ransomware Operator Extradited to US Faces Federal Charges

Alan V Gutnov
Alan V Gutnov

Director of Strategy

 
July 17, 2025 3 min read

Sentencing in Child Exploitation Case

A Medford man, Nicholas James Shaw, has been sentenced to 120 months in federal prison for coercing and sexually exploiting a minor online through platforms such as Snapchat and Kik Messenger. He is also subject to a lifetime term of supervised release and must pay $66,000 in restitution to his victims.

Court documents reveal that between October 2021 and April 2022, Shaw engaged in sexually explicit communications with a minor, coercing the victim into producing and sending explicit materials. A search warrant executed by Homeland Security Investigations (HSI) on June 28, 2022, led to the seizure of electronic devices containing child sexual abuse material. Shaw was arrested shortly after and charged with multiple offenses related to child pornography, ultimately pleading guilty to coercion and enticement of a minor on January 21, 2025. This case was investigated by HSI with support from the Medford Police Department.

For anyone with information about child exploitation, HSI encourages reaching out at (866) 347-2423 or submitting a tip online at report.cybertip.org.

Child Exploitation Case
Image courtesy of MLex


Ransomware Extortion Charges

Karen Serobovich Vardanyan, an Armenian national extradited from Ukraine, faces federal charges for his alleged involvement in a series of Ryuk ransomware attacks. The attacks occurred between March 2019 and September 2020, targeting numerous companies and demanding ransom payments in Bitcoin.

Vardanyan, along with his co-conspirators, is alleged to have illegally accessed computer networks to deploy Ryuk ransomware, extorting approximately 1,610 bitcoins—valued at over $15 million at the time of the payments. Vardanyan made his first appearance in federal court on June 20, 2025, and is awaiting a jury trial set for August 26, 2025.

The Justice Department has highlighted the widespread impact of Ryuk ransomware, which affected various sectors, including healthcare and critical infrastructure. Notable victims include the Hollywood Presbyterian Medical Center and Universal Health Services.

Ryuk Ransomware
Image courtesy of MLex


Federal Charges for Gun Possession

Lucas Christopher Perillo, a West Linn man, faces federal charges for the unlawful possession of machine guns, unregistered firearms, and silencers. Following an FBI investigation on June 17, 2025, agents seized 36 firearms from Perillo’s residence, including three firearms converted to machine guns.

Perillo was arrested on July 11, 2025, and is currently detained pending further court proceedings. This case highlights ongoing efforts by federal law enforcement agencies to address illegal firearm possession and ensure public safety.

Firearm Seizure
Image courtesy of MLex


Assault Charges During Protests

Four defendants were charged for assaulting federal law enforcement officers during protests near a U.S. Immigration and Customs Enforcement (ICE) office in South Portland. The incidents occurred on July 4, 2025, where demonstrators targeted federal officers with threats and physical attacks.

The defendants face various charges, including assault with a deadly weapon and possession of a destructive device. They made their first appearances in federal court and were released pending future court proceedings.

Protest Incident
Image courtesy of MLex


Drug Trafficking Sentences

David Toedtemeier, a Eugene man, was sentenced to 60 months in federal prison for trafficking fentanyl and methamphetamine. His arrest occurred during a traffic stop in January 2022, where law enforcement discovered drugs and a firearm in his vehicle.

Additionally, Gary Wade Ronning, from Salem, received a sentence of 130 months in federal prison for attempting to entice minors online. He was found guilty of multiple charges related to coercion and enticement of minors.

Drug Trafficking
Image courtesy of MLex


For more information on these topics or assistance with related matters, explore our services at [Company Name] or contact us directly.

Alan V Gutnov
Alan V Gutnov

Director of Strategy

 

MBA-credentialed cybersecurity expert specializing in Post-Quantum Cybersecurity solutions with proven capability to reduce attack surfaces by 90%.

Related Articles

Ransomware Attacks Target Russian Vodka and Healthcare Sectors

The Novabev Group, parent company of the Beluga vodka brand, experienced a ransomware attack on July 14, 2025, causing significant disruptions. The attack affected WineLab, the company's liquor store chain, leading to a three-day closure of over 2,000 locations in Russia. The company reported that the attack crippled its IT infrastructure, particularly point-of-sale systems and online services. Novabev Group stated, "The company maintains a principled position of rejecting any interaction with cybercriminals and refuses to fulfill their demands."

By Alan V Gutnov July 19, 2025 3 min read
Read full article

Retail Sector Faces Surge in Ransomware Attacks: A 2025 Analysis

Publicly disclosed ransomware attacks on the retail sector globally surged by 58% in Q2 2025 compared to Q1, with UK-based firms being particularly targeted, according to a report by BlackFog. This spike in attacks follows high-profile breaches affecting retailers like Marks & Spencer (M&S), The Co-op, and Harrods, attributed to the threat actor known as Scattered Spider.

By Alan V Gutnov July 19, 2025 2 min read
Read full article

AI-Driven Lcryx Ransomware Emerges in Cryptomining Botnet

A cryptomining botnet active since 2019 has incorporated a likely AI-generated ransomware known as Lcryx into its operations. Recent analysis by the FortiCNAPP team at FortiGuard Labs identified the first documented incident linking H2miner and Lcryx ransomware. This investigation focused on a cluster of virtual private servers (VPS) utilized for mining Monero.

By Edward Zhou July 19, 2025 3 min read
Read full article

Preventing ClickFix Attacks: Safeguarding Against Human Error

ClickFix is an emerging social engineering technique utilized by threat actors to exploit human error. This technique involves misleading users into executing malicious commands under the guise of providing "quick fixes" for common computer issues. Threat actors use familiar platforms and deceptive prompts to encourage victims to paste and run harmful scripts.

By Alan V Gutnov July 19, 2025 3 min read
Read full article