The spinoff operation named 8Base ramped up its activity in the summer of 2023 and the group claimed responsibility for high-profile attacks on the United Nations Development Programme and the Atlantic States Marine Fisheries Commission as well as a Canadian agency that administers dental benefit plans for disabled people in Alberta. The FBI, alongside law enforcement agencies in Germany, Japan and more, took down more than 100 servers used as part of the Phobos scheme and warned more than 400 companies worldwide of ongoing or imminent ransomware attacks. Phobos administrators made money by conducting their own ransomware attacks, the indictment says, and by distributing the malicious code on the dark web to affiliates. U.S. law enforcement efforts culminated in the arrest and extradition of Russian national Evgenii Ptitsyn — an alleged Phobos administrator — from South Korea in November. “Taking advantage of Phobos’s infrastructure, 8Base developed its own variant of the ransomware, using its encryption and delivery mechanisms to tailor attacks for maximum impact,” Europol said earlier this year. Phobos was particularly damaging because it focused its efforts on attacking smaller businesses and organizations that typically lacked the kind of cybersecurity protections needed to defend against ransomware. Victims of Phobos and 8Base ransomware incidents will now have access to a decryptor thanks to Japan’s National Police Agency. The U.S. Department of Justice unsealed an array of criminal charges against Roman Berezhnoy, 33, and Egor Nikolaevich Glebov, 39, for their alleged roles in using Phobos to earn more than $16 million. The tool was shared by the European Cybercrime Centre and the FBI, which noted that its Baltimore office led an investigation that culminated in charges against Phobos affiliates earlier this year. Phobos is best known for accepting significantly smaller ransoms from attacks, including several under $100,000. On Thursday, Japanese officials published the free decryption tool and a guide in English for organizations impacted by the group’s attacks.
This Cyber News was published on therecord.media. Publication date: Fri, 18 Jul 2025 18:50:17 +0000