LE Quadruple: Rydox Operator Guilty, Ryuk's Vardanyan Sentenced, Oxygen Forensics CEO Arrested

In one week of September 2026, U.S. prosecutors moved four separate cases against people and companies tied to cybercrime and to the tools built around it. A Rydox marketplace operator pleaded guilty in Pennsylvania, a Ryuk ransomware operator was sentenced to two years in Oregon, two leaders of the phone-hacking firm Oxygen Forensics were arrested over allegedly hidden Russian ownership, and an early Scattered Spider member's guilty plea stayed in the enforcement column from earlier in the month. None of the four cases is connected to the others, which is the point: the cadence of named accountability is now steady enough that a single ordinary week produces a plea, a sentence, and a pair of fraud arrests.

This is the second law-enforcement roundup The CyberSignal has run this month, after an earlier quad covering a Swiss ransomware sentence, a Black Axe extradition, a New York deepfake seizure, and a Ukrainian Roblox ring. Here is the week at a glance, with the defender takeaway that matters most in each case.

Rydox Operator Ardit Kutleshi Pleads Guilty

Ardit Kutleshi, 28, pleaded guilty this week to aggravated identity theft and money laundering charges tied to the Rydox cybercriminal marketplace. Kutleshi was extradited from his home country of Kosovo last year after prosecutors accused him and his older brother of running Rydox, an illicit platform used by cybercriminals to sell stolen personal information, illegal access to devices, and other tools for carrying out fraud, The Record reported.

The consequential terms are still to come. Kutleshi will be sentenced in February and faces a mandatory minimum of two years in prison on the aggravated identity theft charge and a maximum of 20 years on the money laundering count, according to The Record. His older brother previously pleaded guilty, was sentenced to time served, and was deported back to Kosovo in December, the report said.

Prosecutors put a size on the operation. Rydox ran for nearly a decade and facilitated more than 7,600 transactions that brought in about $232,000, with roughly 18,000 users who bought items such as Social Security numbers and manuals on how to build scam pages. U.S. Attorney Troy Rivetti said the brothers made "hundreds of thousands of dollars from the marketplace where cybercriminals could purchase information and tools to effect and further their online crime." Law enforcement seized the domain that hosted the platform in December 2024, when Kutleshi was arrested in Kosovo, with assistance from authorities in Albania and Malaysia.

The defender takeaway sits upstream of any single breach. A marketplace like Rydox is a clearinghouse for the raw material of account takeover and fraud: identities, logins, and how-to guides. A guilty plea removes one operator, but it does not retire the stolen data already sold. Treat exposed employee and customer identity data as a standing risk, monitor for it, and require step-up verification on the actions that a stolen identity would otherwise unlock. Credential theft and resale is one node in the broader map of attack types defenders have to plan against, not a niche concern for fraud teams alone.

Ryuk Operator Karen Vardanyan Sentenced to Two Years

Karen Vardanyan, a 35-year-old Armenian national, was sentenced to two years in prison for his role in a series of Ryuk ransomware attacks carried out while he was living in Ukraine and Russia in 2019 and 2020, the Justice Department said. The sentence also calls for about $1.2 million in restitution to victims and matches the terms of a plea agreement he reached with prosecutors, CyberScoop reported.

Vardanyan was extradited from Ukraine to the United States last year and pleaded guilty in July to computer fraud and conspiracy to commit fraud and extortion. This week's sentence is the closing chapter of that case, not a fresh charge. According to court records cited by CyberScoop, the victims included a Michigan-based company that paid a ransom of nearly $1.2 million in January 2020, a technology company in Watsonville, Oregon, attacked in December 2019, and a Texas-based school breached in February 2020. Prosecutors said Vardanyan and his co-conspirators received about 1,160 bitcoins, valued at more than $15 million at the time, in ransom payments.

The sentencing memo is worth reading for how prosecutors framed the deterrent logic. "Like Vardanyan, many cybercriminals are not masterminds of a complex ransomware or extortion scheme but nonetheless play an integral part in the success of these crimes," read a memo signed by U.S. attorneys in the District of Oregon. "Unfortunately, high rewards and a relatively low risk of detection are basic features of cybercrime. The only way to affect the cost-benefit analysis of these crimes is to impose meaningful sentences on those who are caught."

For defenders, the case changes no control you should not already have. Ryuk was prevalent in 2019 and 2020, hitting the private sector, municipalities, school districts, and critical infrastructure, including a wave of attacks on U.S. hospitals. A single two-year sentence does not recover a historical ransom or reverse an outage. What still decides outcomes against that class of attack has not changed: tested, offline backups you have actually restored from, segmentation that limits lateral movement, and detections tuned to the behaviors of ransomware families rather than to a specific sample. The names in the docket change; the recovery discipline does not.

Oxygen Forensics Leaders Arrested Over Hidden Russian Ownership

The Justice Department arrested two leaders of the phone-hacking firm Oxygen Forensics, charging them with conspiracy to commit wire fraud for allegedly masking the company's Russian ownership in order to win millions of dollars in U.S. government contracts. Lee Reiber of Boise, Idaho, the CEO of Oxygen Forensics (Oxygen US), was arrested in his home state, and Oleg Davydov, described as one of five Russian nationals who actually controlled the company, was arrested in London, where the department plans to seek his extradition, CyberScoop reported.

The allegation is about concealment, not a technical compromise. According to the criminal complaint, Oxygen presented Reiber as the true leader of a company based in Alexandria, Virginia, and told government agencies it was U.S.-owned, while Russian officials with the company repeatedly overruled him. The company installed Reiber as CEO and removed the owners from public corporate filings in 2022, after the United States expanded sanctions on Russia following its invasion of Ukraine, the complaint alleges. Since March 2022, Oxygen sold its forensics software to the U.S. Secret Service, Homeland Security Investigations, the DHS inspector general, and the Defense Department, and won more than $2 million in contracts and purchases from the Secret Service and its National Computer Forensics Institute.

Prosecutors argued the ownership question was material to the buyers. "Procurement officials at the U.S. government customers have represented that they would not have awarded or renewed contracts for the forensic software had they known that OxygenUS was a Russian-owned company," the complaint reads, per CyberScoop. The DOJ also specified that the complaint "does not allege that the software contained malicious code or that it was used to gain unauthorized access to any customer's computer systems or data."

My read, offered as assessment rather than a reported fact, is that this is the defender-relevant case of the four, precisely because it is not a hacking case. The risk here is supply-chain and provenance: a tool with deep access to sensitive data whose real ownership was, as alleged, hidden from the agencies buying it. The practical lesson generalizes past this one vendor. For any product that ingests forensic images, endpoint data, or other sensitive material, ownership and control are a security property, not just a procurement footnote. Ask who ultimately owns and directs a vendor, whether that answer has changed, and what would happen to your data if the honest answer differed from the one on the contract.

Scattered Spider: The Enforcement Thread Continues

Scattered Spider stays in the enforcement column this week as a continuation rather than a new event. An early member of the group, Ahmed Elbadawy, has pleaded guilty in a cybercrime case, part of the steady run of U.S. prosecutions against members of the loose, social-engineering-driven collective. There is no new sentencing or charge to report here this week; the thread is noted for continuity with prior coverage. Defenders tracking this group should keep the focus where it has always paid off: help desks, identity providers, and account-recovery paths, which remain the group's favored way in.

What Law Enforcement and Industry Watchers Should Track

Read together, the four items show a division of labor in enforcement that mirrors the division of labor in cybercrime itself. A marketplace operator pleads guilty in one district while the data his platform sold stays in circulation. A ransomware operator described by prosecutors as a participant rather than a mastermind is sentenced, while the people at the top of that operation are not named as caught. A vendor's leaders are arrested for how the company was owned and presented, not for how its software worked. And a social-engineering crew keeps generating individual pleas long after its splashiest intrusions.

The through-line, offered as analysis, is that enforcement in 2026 is targeting people and provenance, not just malware brands. That is the same pattern behind the month's earlier law-enforcement quad: a developer sentenced in one country while the alleged ringleader stays at large in another. None of these actions dismantles a criminal economy on its own. The value is cumulative. A finite pool of skilled operators, the erosion of the safe-harbor assumption through extradition, and the growing habit of attaching restitution to pleas all raise the cost of doing business at every layer of the stack.

For security leaders, the useful move is to treat this enforcement record as context for internal risk conversations rather than as a control. Extradition and prosecution are slow relative to the pace of intrusions, and a conviction never patches a system. What these cases do supply is evidence for two arguments worth making inside an organization: that identity data and vendor provenance are security concerns with real legal weight behind them, and that recovery discipline against ransomware matters regardless of which operator is in custody this quarter.

Open Questions

Several threads remain open. In the Rydox case, it is not yet public whether Kutleshi will be deported after his February sentencing, as his brother was, or how the mandatory-minimum and money-laundering exposures resolve at sentencing. In the Ryuk case, prosecutors said they found no evidence Vardanyan was still active at the time of his arrest, and his co-conspirators named in earlier filings have not been reported as sentenced, leaving open how far up the operation the accountability reaches. In the Oxygen Forensics case, the charges are allegations at the complaint stage: Davydov's extradition from London is not settled, and the agencies that bought the software have not detailed what, if anything, they will change about tools already in use. And the Scattered Spider prosecutions continue to raise the question of how many more members face charges, and on what timeline. The CyberSignal will update this record as these cases move.

Primary Documents

• The Record: Rydox cybercriminal marketplace operator pleads guilty
• CyberScoop: Ryuk ransomware operator sentenced to 2 years in prison
• SecurityWeek: U.S. court sentences Armenian man to prison for Ryuk ransomware attacks
• CyberScoop: Phone-hacking company that won U.S. security agency contracts hid Russian ownership, DOJ alleges