Evgenii Ptitsyn, a Russian nationwide and suspected administrator of the Phobos ransomware operation, was extradited from South Korea and is going through cybercrime prices in the USA.
Phobos is a long-running ransomware-as-a-service (RaaS) operation (derived from the Crysis ransomware household) extensively distributed by many associates. Between Could 2024 and November 2024, it accounted for roughly 11% of all submissions to the ID Ransomware service.
The Justice Division has linked the Phobos ransomware gang to breaches of over 1,000 private and non-private entities in the USA and worldwide, with ransom funds price greater than $16 million.
Based on courtroom paperwork, Ptitsyn and his co-conspirators allegedly developed and, beginning in November 2020, offered Phobos associates with entry to the ransomware payloads wanted to encrypt the victims’ programs and the platform used to extort ransom funds.
“The administrators operated a darknet website to coordinate the sale and distribution of Phobos ransomware to co-conspirators and used online monikers to advertise their services on criminal forums and messaging platforms. At relevant times, Ptitsyn allegedly used the monikers ‘derxan’ and ‘zimmermanx,'” the Justice Division mentioned.
Phobos associates allegedly hacked into the victims’ networks utilizing stolen credentials to steal information and deploy Phobos ransomware to encrypt their information.
Additionally they left ransom notes and contacted victims by calls and emails, making an attempt to extort every sufferer and demanding ransom funds in alternate for decryption keys below the specter of leaking their stolen information on-line in the event that they did not pay.
​After assaults that resulted in a ransom cost, the associates paid Phobos directors, together with Ptitsyn, for the decryption keys. Because the Justice Division mentioned on Monday, every ransomware deployment had a singular alphanumeric string that linked it to the corresponding key, and the funds had been directed to particular cryptocurrency wallets distinctive to every affiliate.
“From December 2021 to April 2024, the decryption key fees were then transferred from the unique affiliate cryptocurrency wallet to a wallet controlled by Ptitsyn,” the Justice Division added.
Ptitsyn is charged in a 13-count indictment, together with wire fraud, conspiracy to commit laptop fraud, and extortion associated to hacking. If convicted, he faces as much as 20 years for every wire fraud rely, 10 years for every hacking rely, and 5 years for conspiracy prices.
“Ptitsyn and his co-conspirators hacked not only large corporations but also schools, hospitals, nonprofits, and a federally recognized tribe, and they extorted more than $16 million in ransom payments,” mentioned Nicole M. Argentieri, the top of the Justice Division’s Felony Division.
“We are especially grateful to our domestic and foreign law enforcement partners, like South Korea, whose collaboration is essential to disrupting and deterring the most significant cybercriminal threats facing the United States.”
