Phobos Ransomware Developer Pleads Guilty, Faces Up to 20 Years
Summary
Evgenii Ptitsyn pleaded guilty to wire fraud over his alleged role as a key Phobos ransomware developer and operator. He faces up to 20 years; prosecutors link Phobos and 8Base to attacks on more than 1,000 organizations.
Key points
- Evgenii Ptitsyn pleaded guilty to wire fraud after prosecutors accused him of being a key developer and operator of the Phobos ransomware group.
- Ptitsyn faces up to 20 years in prison and is scheduled to be sentenced on July 15.
- He was arrested in South Korea and extradited to the U.S. in November 2024.
- Prosecutors say Phobos and related strain 8Base were linked to attacks on more than 1,000 organizations; they accused Ptitsyn of involvement in attacks on a California public school system that paid a $300,000 ransom in 2023.
- U.S. prosecutors said Phobos and 8Base operators collected more than $16 million from victims worldwide dating back to 2019.
- Law enforcement agencies have arrested and prosecuted other members, and Japanese officials released a free Phobos decryption tool and guide last July.
Article Details
- Event Type
- Criminal prosecution: Evgenii Ptitsyn pleaded guilty to wire fraud in connection with the Phobos ransomware operation.
- Impact
- Ptitsyn faces up to 20 years in prison. Prosecutors linked Phobos and related strain 8Base to attacks on more than 1,000 organizations and said their operators collected over $16 million since 2019. Victims included healthcare organizations and a California public school system that paid a $300,000 ransom in 2023.
Threat Actors
Evgenii PtitsynU.S. prosecutors accused him of being a key developer and operator of the Phobos ransomware operation, marketing the ransomware and running its data-leak site. He pleaded guilty to wire fraud; the article reports that he faces sentencing.PhobosIdentified in the article as a ransomware gang whose operators attacked organizations and received ransom payments. Prosecutors accused Ptitsyn of being a key developer and operator.
Malware
Countries
Polandand Europe have arrested and prosecuted multiple members of the group over the last two years, including a 47-year-old man detained in Poland three weeks ago.South KoreaHe faces up to 20 years in prison, was extradited from South Korea in November 2024, and is linked to attacks on over 1,000 victims including a California public school system that paid $300,000.ThailandSeveral members were arrested and deported from Thailand last year.United StatesEvgenii Ptitsyn, a 43-year-old Russian national, pleaded guilty to wire fraud after U.S.