Most ransomware stories focus on the “ransom note moment.” The scarier part happens days or weeks earlier: someone quietly gets a foothold inside the network, tests what they can reach, then hands that access to the crew that deploys the encryption. The sentencing of Armenian national Karen Serobovich Vardanyan (aka “Maneeken”/“Karl Lagerfeld”) is a reminder that ransomware isn’t just malware—it’s a supply chain of specialized roles, and initial access is the front door. Prosecutors say his access helped fuel Ryuk-era intrusions hitting multiple U.S. orgs in 2019–2020, including a Michigan company that paid 200 BTC, plus targets in Texas and Oregon .
The case, in plain English: what an “initial access broker” actually does
If ransomware is a bank robbery, an initial access broker (IAB) is the person who quietly steals the keys, checks which doors open, then sells that entry to the crew that brings the guns.
That’s the core of what prosecutors say Karen Serobovich Vardanyan (aka “Maneeken” / “Karl Lagerfeld”) did in the Ryuk era: he specialized in gaining initial access to corporate networks . Not “write ransomware.” Not “negotiate ransoms.” The unglamorous part that makes the whole operation possible.
What “initial access” looks like in real life
In most ransomware operations, early access is quiet, credential-heavy, and remote-access-friendly. Think:
- Stolen usernames/passwords (often reused)
- Exposed RDP or remote admin tools
- Weak or missing MFA on VPN and email accounts
- One compromised user that turns into domain-wide reach
Once inside, the IAB’s job is to make the access reliable and repeatable—the kind you can hand off without babysitting it. That means mapping the network, identifying high-value systems, and helping set up a path that survives reboots and password changes.
Why this role prints money
The DOJ description is blunt: Vardanyan and co-conspirators allegedly accessed victim networks and deployed ransomware across hundreds of compromised servers and workstations . That scale doesn’t happen by accident. It’s what you get when the “front door” work is done well.
The victim examples show the business impact of that early foothold:
- A Michigan company paid 200 BTC (over $1.1M at the time) after an intrusion linked to this activity
- Prosecutors also pointed to a Texas school and a technology company in Wilsonville, Oregon as victims
- Total alleged ransom intake tied to the conspiracy: ~1,610 BTC (valued at over $15M at the time of payment)
That’s the part most teams miss: the “ransomware attack” is often the final step in a chain where access is the product. And when access is a product, the criminal operation can run like a pipeline—one specialist gets in, another escalates privileges, another pushes Ryuk.
Ryuk’s operating model (2018–2020): why this one hit so hard
Once you understand that “access” can be bought and sold, Ryuk’s run makes ugly sense. Ryuk operated as a ransomware-as-a-service (RaaS) style setup from August 2018 through mid-2020 . That matters because RaaS isn’t one crew doing everything. It’s a pipeline.
The Ryuk “assembly line”: specialists, handoffs, speed
Ryuk-era operations were built for throughput. One set of people focuses on entry. Another focuses on expanding control. Another handles the ransomware run and the pressure tactics. That division of labor is exactly why an initial access broker is such a powerful force multiplier: the ransomware team doesn’t have to spend weeks “finding a way in.” They can pay for a working foothold and go straight to takeover.
In practical terms, a pipeline model tends to create three outcomes:
- Lower time-to-impact: fewer failed attempts, more consistent intrusions.
- Repeatable playbooks: the same entry paths work across many orgs, so attackers get efficient.
- Bigger blasts: once the “operator” stage begins, they push hard to spread fast and wide.
And Ryuk operators were known for going big—waves of attacks that weren’t subtle.
The tempo was brutal (and defenders felt it)
At peak, reports pegged Ryuk at around 20 victims every week . That kind of volume doesn’t happen with one-off opportunistic hacking. It happens when:
- access is being fed in continuously,
- operators are organized,
- the same tooling and steps get reused.
The money matched the pace. Ryuk reportedly collected more than $150 million in ransoms . When defenders hear numbers like that, they sometimes assume “nation-state level.” Ryuk’s lesson is harsher: a well-run criminal production line can cause that scale.
Why healthcare got squeezed during COVID-19
Ryuk also became notorious for a massive wave of attacks targeting the healthcare sector during the COVID-19 pandemic . Healthcare networks are complex, uptime is life-or-death, and the tolerance for downtime is near zero. In a ransomware economy, that’s pressure attackers can monetize.
This is the part people should sit with: Ryuk wasn’t “just malware.” It was an operating model that rewarded specialization—and punished any organization that treated remote access, credentials, and internal sprawl as “tomorrow problems.”
Evolution after Ryuk: Conti, splinter crews, same playbook
Ryuk “ending” didn’t mean the business model broke. It meant the branding changed.
Threat reporting tied to this ecosystem points out a clean handoff: after Ryuk shut down in 2020, the Wizard Spider group behind it switched to Conti ransomware . Same idea, new wrapper. If you were hoping law enforcement pressure or public attention would make the problem go away, this is the reality check.
The Conti phase: when a successor is basically a continuation
Conti quickly became one of the most prolific operations after the switch . What that signals for defenders is simple: when an operation has a working “factory,” it doesn’t need to reinvent tactics. It needs to keep the pipeline fed.
That pipeline still depends on repeatable entry paths:
- Initial access that can be bought, traded, or re-used
- Credential abuse (valid logins beat a lot of security controls)
- Remote access exposure (VPN, RDP, and admin tooling that’s reachable from the internet)
2022 wasn’t “the end” either
Conti also disbanded in 2022 after its internal chats and source code were leaked, and the group splintered into multiple smaller units . Some units reportedly blended into other ransomware gangs; others spun up new operations .
That splintering creates a weird effect for security teams:
- You see more names and more “new” groups.
- Your execs ask, “Is this a different threat actor?”
- Your exposure is often the same 5–10 controllable problems you already had.
Practical takeaway: stop chasing logos, track the entry recipe
Ransomware crews rebrand because it buys them time—confusion in reporting, confusion in attribution, and fresh recruiting channels. Defenders can’t win that game by memorizing group names.
Win it by watching for what doesn’t change: how they get in, how they keep access, and how they move laterally once a single account is compromised.
Defensive moves that actually break the chain (and where teams slip up)
Rebrands keep happening because the entry points stay open. If you want to beat the “same playbook,” you have to break it at two points: initial access and lateral movement. The DOJ description of Ryuk-era intrusions spreading across hundreds of servers and workstations is the warning label here .
1) Credential hygiene (boring, effective, always skipped)
Attackers love valid credentials because they look like normal work.
Do this, consistently:
- Kill shared admin logins. If multiple people use the same admin account, you’ve built an attacker-friendly “one password = many privileges” system.
- Separate admin and user accounts. Admin work should happen from admin identities, not everyday email identities.
- Rotate and revoke aggressively. When someone leaves or a vendor contract ends, access should end the same day.
- Watch for credential reuse. The same password across VPN, email, and a legacy app is how one foothold turns into a full compromise.
Where teams slip up: “We’ll clean up accounts after this project.” The project never ends.
2) MFA that can’t be bullied (or bypassed)
MFA is table stakes. Weak MFA operations still get owned.
- Require MFA on VPN, email, remote admin tools, and privileged actions.
- Prefer phishing-resistant MFA for admins where possible.
- Block legacy/basic auth paths that quietly bypass MFA.
Where teams slip up: MFA fatigue. Users get spammed with prompts and hit “approve” to make the noise stop.
3) RDP + VPN hardening (your front door needs a deadbolt)
If the internet can reach your remote access, ransomware crews will find it.
- RDP: don’t expose it directly. If it must exist, restrict to allowlisted sources and enforce strong authentication controls.
- VPN: keep it patched, require MFA, and limit who can connect and from where.
- Reduce remote access sprawl: fewer portals, fewer exceptions, fewer “temporary” openings.
Where teams slip up: “We opened RDP for a vendor for the weekend.” It’s still open three months later.
4) Monitoring that catches the setup, not just the detonation
Ransomware rarely starts with encryption. It starts with changes that make encryption easy.
Put high-signal detections around behaviors like:
- New admin accounts created outside change windows
- Unusual remote logins (odd geographies, odd hours, new devices)
- Sudden privilege changes (user → admin)
- Mass changes that weaken defenses (services stopped, security tools disabled)
Where teams slip up: alert overload. The first foothold shows up as “one weird login,” buried under 500 low-priority notifications.
A quick gut-check for leadership
If your security posture assumes you’ll “catch the ransomware,” you’re already late. The goal is to catch the steps that let attackers fan out across the environment—the same kind of broad compromise described in Ryuk-era cases .
A small but meaningful privacy angle: reduce the credential blast radius outside your network
Most ransomware post-mortems zoom in on what happened inside the network. A lot of compromises start earlier, outside your perimeter, with something painfully normal: an email address, a phone number, and a password that got reused.
That’s why “privacy hygiene” can be a security control. Not a silver bullet. A small edge that reduces how often attackers get a clean starting point.
How everyday sign-ups turn into account takeover fuel
Here’s the common chain:
- Employees sign up for vendor trials, webinars, newsletters, “quick demos,” and random SaaS tools using a real work email (or the same personal email they’ve had for years).
- That inbox gets hit with more spam and more targeted phishing because it’s now spread across dozens of marketing lists.
- Credentials from unrelated sites get exposed, then tested at scale through credential stuffing. If any password reuse exists, attackers land valid logins without exploits.
- A “non-essential” account becomes a stepping stone into the org, the same kind of access that later supports wide-scale ransomware deployment across environments .
If you’re thinking “our employees know better,” sure. But people get tired. They click “Sign up with Google/Microsoft.” They reuse passwords. They approve the wrong prompt once.
A practical policy: separate identity for low-trust sign-ups
You don’t need to ban trials and research. You need to stop tying them to core identities.
Good targets for separation:
- Vendor newsletters and webinar registrations
- Free trials for tools your team is evaluating
- Non-critical support portals and community forums
- One-off procurement conversations that don’t require permanent identity linkage
Where Cloaked fits (without making this a product pitch)
This is one of the few places a privacy tool maps cleanly to a ransomware control. Cloaked lets people use masked emails and phone numbers for sign-ups and vendor interactions, so an employee’s real contact details don’t get sprayed across the internet and stitched together over time.
That does two useful things:
- Limits linkage: attackers have a harder time correlating an employee to a company role and building believable pretexts.
- Reduces credential exposure pressure: fewer places your real email/phone live means fewer phishing and account-takeover attempts funneling back into work accounts.
It won’t fix weak MFA or exposed VPN. But it can shrink the outside-the-network mess that attackers love to start from—and that’s one less easy lane into your environment.
