U.S. and International Authorities Arrest Phobos Ransomware Affiliates in Major Cybercrime Crackdown

The U.S. Department of Justice has unsealed criminal charges against two Russian nationals accused of running a cybercrime operation that deployed Phobos ransomware, targeting more than 1,000 victims worldwide. Roman Berezhnoy, 33, and Egor Nikolaevich Glebov, 39, were arrested as part of a coordinated international effort that also included the disruption of the group’s computer infrastructure. The ransomware attacks allegedly extorted over $16 million in ransom payments from victims, which included hospitals, healthcare providers, and educational institutions.

According to court documents, Berezhnoy and Glebov operated as part of a ransomware affiliate network known as “8Base” and “Affiliate 2803.” Since 2019, they allegedly hacked into computer systems, encrypted stolen data with Phobos ransomware, and demanded ransom payments from victims. If the payments were not made, the perpetrators threatened to publish the stolen information on a darknet website. The scheme required criminal affiliates to pay fees to the Phobos administrators for decryption keys, with each deployment of the ransomware assigned a unique identifier to facilitate payments via cryptocurrency wallets.

In addition to the arrests, law enforcement agencies from the United States, Europol, and Germany announced a coordinated operation to dismantle more than 100 servers used by the cybercriminal group. These arrests follow the recent extradition of Evgenii Ptitsyn, another Russian national accused of overseeing Phobos ransomware operations. Berezhnoy and Glebov face an 11-count indictment, including charges of wire fraud, conspiracy to commit computer fraud, and extortion related to damage to protected computers. If convicted, they face up to 20 years in prison for wire fraud-related charges, 10 years for computer damage offenses, and five years for additional charges.

The FBI Baltimore Field Office led the investigation, with support from international law enforcement agencies across Europe and Asia, as well as the U.S. Department of Defense Cyber Crime Center. The Justice Department emphasized its ongoing efforts to combat ransomware and urged organizations to take preventative cybersecurity measures, directing them to resources at StopRansomware.gov.

Article by multiple RFHC contributors.

---