Phobos Ransomware Administrator Pleads Guilty to Wire Fraud Conspiracy
Summary
Evgenii Ptitsyn pleaded guilty to wire fraud conspiracy for administering Phobos ransomware. Authorities say the operation collected over $39 million from more than 1,000 organizations; coordinated enforcement actions seized servers and led to arrests.
Key points
- Evgenii Ptitsyn pleaded guilty to wire fraud conspiracy for his role administering the Phobos ransomware operation.
- Ptitsyn was extradited from South Korea in November 2024 and faces up to 20 years; sentencing is scheduled for July 15.
- The U.S. Department of Justice says Phobos collected over $39 million from more than 1,000 public and private organizations.
- Affiliates commonly used stolen credentials to access victim networks, exfiltrate files, and encrypt data before demanding payment.
- Phobos administrators charged affiliates about $300 per deployment for a decryption key and received a share of ransom payments.
- Operation Aether involved international law enforcement actions, including server seizures and arrests; Europol said authorities warned more than 400 companies of ongoing or imminent attacks.
Article Details
- Event Type
- Criminal guilty plea and law-enforcement disruption of the Phobos ransomware operation
- Impact
- Evgenii Ptitsyn pleaded guilty to wire fraud conspiracy for administering Phobos. The U.S. Department of Justice says the operation collected more than $39 million from over 1,000 public and private entities. Affiliates used stolen credentials to access victims’ networks, exfiltrated files, and encrypted sensitive data. Operation Aether disrupted Phobos-linked infrastructure, including the seizure of 27 servers, and law enforcement said it warned more than 400 companies of ongoing or imminent attacks.
MITRE ATT&CK
People
Threat Actors
Malware
CrysisPhobos, linked to the Crysis ransomware family, accounted for about 11% of ID Ransomware submissions from May–November 2024.PhobosA Russian national, Evgenii Ptitsyn, pleaded guilty to a wire fraud conspiracy for administering the Phobos ransomware operation that breached hundreds of victims worldwide and helped collect over $39 million from more
Countries
ItalyOther key results of this operation include a massive disruption in February 2025, when police detained two suspected affiliates and seized 27 servers, and the arrest of another affiliate in Italy in 2023.South KoreaHe was extradited from South Korea, faces up to 20 years with sentencing set for July 15, and international law enforcement actions under Operation Aether disrupted Phobos infrastructure and led to multiple arrests.United StatesThe U.S. Department of Justice says the ransomware gang has collected ransom payments worth more than $39 million million from over 1,000 public and private entities worldwide.