Russian Ransomware Administrator Admits Guilt in Widespread Extortion Scheme

A Russian national has pleaded guilty in federal court to charges stemming from his role in administering a sophisticated ransomware operation that targeted over 1,000 public and private entities worldwide, extorting more than $39 million in payments. Evgenii Ptitsyn, 43, admitted to his involvement in the wire fraud conspiracy that facilitated the sale, distribution, and operation of Phobos ransomware. U.S. Attorney Kelly O. Hayes of the District of Maryland announced the guilty plea, which follows Ptitsyn’s extradition from South Korea in November 2024.

The scheme, which began in at least November 2020, involved Ptitsyn and his co-conspirators developing and offering access to the Phobos ransomware to other criminal actors, known as “affiliates.” These affiliates were responsible for hacking into victim networks, stealing data, and encrypting it using the Phobos ransomware. To extort ransom payments, affiliates would leave notes on compromised computers and contact victims directly to negotiate. Threatening to publicly release stolen data was also a common tactic used to coerce payments. Ptitsyn and his partners operated a darknet website to manage the sale and distribution of the ransomware, using online aliases to advertise their illicit services on criminal forums and messaging platforms.

Following successful ransomware attacks, affiliates would pay fees to administrators like Ptitsyn for decryption keys to restore victims’ access to their encrypted data. These fees were typically funneled through cryptocurrency wallets. From December 2021 to April 2024, Ptitsyn received a share of these decryption key fees through a cryptocurrency wallet he controlled, in addition to a portion of the ransom payments made by victims. Ptitsyn now faces a maximum penalty of 20 years in prison for the wire fraud conspiracy charge. His sentencing is scheduled for Wednesday, July 15, at 2:30 p.m.

The successful prosecution of this case involved significant international cooperation. U.S. Attorney Hayes acknowledged the efforts of the FBI, along with law enforcement agencies in South Korea, the United Kingdom, Japan, Spain, Belgium, Poland, the Czech Republic, France, Romania, and Europol. The U.S. Department of Defense Cyber Crime Center also played a role in the investigation. Assistant U.S. Attorney Thomas M. Sullivan and Senior Counsel Frank Lin of the Criminal Division’s Computer Crime and Intellectual Property Section are prosecuting the case. For individuals and organizations seeking to enhance their defenses against ransomware attacks, resources are available at StopRansomware.gov, including Cybersecurity and Infrastructure Security Agency Advisory AA24-060A. Further information about the Maryland U.S. Attorney’s Office and its initiatives can be found at justice.gov/usao-md and justice.gov/usao-md/report-fraud.

Article by Mel Anara, based upon information from the U.S. Attorney’s Office, District of Maryland

---