Polish Police Arrest Man Allegedly Linked to Phobos Ransomware Operation
Summary
Polish police arrested an unnamed 47-year-old allegedly linked to Phobos after finding encrypted messages on his computer. The arrest comes amid Operation Aether actions against Phobos and 8Base, including arrests and more than 100 server takedowns.
Key points
- Polish police arrested an unnamed 47-year-old in Małopolska in an operation coordinated in Katowice and Kielce; he faces up to five years in prison.
- Police said encrypted messages found on the man’s computer linked him to members of the Phobos group.
- The article says Phobos targeted more than 1,000 organizations. U.S. prosecutors said Phobos and related 8Base operators collected more than $16 million from victims since 2019.
- Operation Aether included international arrests, the extradition of alleged Phobos administrator Evgenii Ptitsyn, and the takedown of more than 100 servers.
- Authorities warned more than 400 companies worldwide of ongoing or imminent ransomware attacks.
Article Details
- Event Type
- Polish police arrested a man accused of involvement with the Phobos ransomware operation, amid international law-enforcement actions against Phobos and 8Base.
- Impact
- The unnamed 47-year-old suspect faces up to five years in prison. Police said they found encrypted messages linking him to Phobos members. The article reports that Phobos and 8Base attacked more than 1,000 organizations; U.S. prosecutors said the operations collected over $16 million from victims.
Threat Actors
8baseDescribed as a Phobos spinoff operation associated with attacks on organizations worldwide; U.S. prosecutors said its operators, together with Phobos operators, collected over $16 million.Egor Nikolaevich GlebovCharged by U.S. authorities for an alleged role in Phobos.Evgenii PtitsynIdentified by Polish officials as the alleged Phobos administrator; extradited to the United States from South Korea in 2024.PhobosRansomware group whose members were allegedly linked to the Polish suspect through encrypted messages; the article reports that the group attacked organizations worldwide.Roman BerezhnoyCharged by U.S. authorities for an alleged role in Phobos.
Malware
8BaseInternational law enforcement actions under Operation Aether have disrupted Phobos and its spinoff 8Base—linked to attacks on over 1,000 organizations and roughly $16 million in extorted payments—resulting in arrests,PhobosPolish police arrested a 47-year-old man in MaÅopolska for alleged involvement with the Phobos ransomware operation after finding encrypted communications during raids coordinated in Katowice and Kielce, and he now
Countries
GermanyThe FBI, alongside law enforcement agencies in Germany, Japan and more, took down more than 100 servers used as part of the Phobos scheme and warned more than 400 companies worldwide of ongoing or imminent ransomwareJapanThe FBI, alongside law enforcement agencies in Germany, Japan and more, took down more than 100 servers used as part of the Phobos scheme and warned more than 400 companies worldwide of ongoing or imminent ransomwarePolandA 47-year-old man was arrested in Poland for his alleged involvement with the Phobos ransomware operation.South Koreafrom South Korea in 2024 and multiple other members of Phobos are now facing charges.ThailandAs part of Operation Aether, two men and two women were arrested after raids in Phuket, Thailand.United StatesU.S. prosecutors previously said operators of Phobos and a related strain called 8Base collected upwards of $16 million from victims worldwide dating back to 2019.
Industries
Accounting and consultingA Maryland-based company that provided accounting and consulting services to federal agencies.Critical infrastructureVictims included hospitals, schools, government agencies, and critical infrastructure, with ransom payments ranging from under $12,000 to $300,000.Educationtribal and territorial governments — damaging “municipal and county governments, emergency services, education, public healthcare, and other critical infrastructure entities to successfully ransom several millionEmergency Servicesstate, local, tribal and territorial governments — damaging “municipal and county governments, emergency services, education, public healthcare, and other critical infrastructure entities to successfully ransomGovernmentVictims included hospitals, schools, government agencies, and critical infrastructure, with ransom payments ranging from under $12,000 to $300,000.Healthcaregovernments — damaging “municipal and county governments, emergency services, education, public healthcare, and other critical infrastructure entities to successfully ransom several million U.S.