The Japanese police have released a Phobos and 8-Base ransomware decryptor that lets victims recover their files for free, with BleepingComputer confirming that it successfully decrypts files. The Japanese police have now released a free decryptor for organizations and people whose files were encrypted by Phobos and 8Base ransomware operations. BleepingComputer can confirm that the decryptor successfully decrypted all 150 files encrypted by the LIZARD variant of Phobos ransomware. Phobos and 8Base ransomware victims should try this decryptor, even if their encrypted files do not have one of the listed extensions, as it may still work. However, the Japanese police says that several other extensions may be supported, so it is worth testing the decryptor even if your files do not have the listed extensions. As a test, BleepingComputer infected a virtual machine with a recent Phobos ransomware variant that adds the .LIZARD extension to encrypted file names, as shown below. However, BleepingComputer has tested the decryptor, and not only is it not malicious, but it also successfully decrypts encrypted files from recent encryptors. It should be noted that you can select the root of a drive, and the decryptor will recursively decrypt files, recreating the same folder structure in the destination folder. When ready, click on the Decrypt button, and the decryptor will attempt to recover your files to the selected folder. While the ransomware operation did not receive as much media attention as other ransomware operations, Phobos is considered one of the most widely distributed ransomware operations, responsible for many attacks on businesses worldwide. Unlike other affiliates, this group engaged in double extortion where they encrypted files and stole data, threatening to release it if a ransom was not paid. In 2024, a Russian national suspected of being the administrator for the Phobos ransomware operation was extradited from South Korea to the United States to face charges in a 13-count indictment. While it is unclear how they were able to create the decryptor, it is believed it was made possible through information obtained during this year's disruption of the ransomware gang.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Fri, 18 Jul 2025 16:00:15 +0000