A global law enforcement operation has resulted in the arrest of four Russian nationals accused of involvement in more than 1,000 ransomware attacks worldwide. The operation, named “Phobos Aetor,” led to the arrests in Phuket, Thailand, according to Bavarian police. The suspects are believed to be linked to the 8base ransomware group, which is considered one of the largest affiliates of the Phobos ransomware-as-a-service (RaaS) operation.
Phobos has been associated with the 8base data extortion group, and part of the operation saw authorities seize the group's darknet leak site.
The U. S. Department of Justice recently unsealed charges against two of the arrested individuals, Roman Berezhnoy, 33, and Egor Nikolaevich Glebov, 39. They are accused of running the 8base affiliate organization, which allegedly deployed Phobos ransomware against various public and private entities.
In the past, the FBI had raised concerns that Phobos was used in attacks targeting critical infrastructure, including local governments, emergency services, and healthcare organizations across the U. S. Europol also reported that 8base not only utilized the Phobos ransomware but also developed its own variant, leveraging Phobos’ infrastructure.
Law enforcement seized mobile phones, laptops, and digital wallets. They also took down more than 100 servers linked to the ransomware network. Europol noted that they were able to warn over 400 companies about potential or ongoing ransomware attacks as part of the operation.
This global takedown highlights the ongoing efforts by law enforcement to combat ransomware attacks and their presence on the darknet, where these operations continue to pose significant challenges.