Loading malware…
Phobos is a Windows ransomware family distributed through a ransomware-as-a-service model, in which affiliates conduct intrusions and share proceeds with the operators. It is closely related to Dharma and the broader CrySis lineage, sharing ransom-note conventions, encrypted-file naming patterns, and negotiation practices. Phobos has affected businesses worldwide, particularly small and medium-sized organizations, as well as local governments, emergency services, educational institutions, healthcare providers, and other critical infrastructure entities.
Phobos intrusions commonly begin through exposed or poorly secured Remote Desktop Protocol services and compromised remote desktop connections. The ransomware encrypts victim files and appends identifying information used for ransom negotiations. Customized Phobos variants, including those deployed by 8Base, use AES-256-CBC file encryption with RSA-protected encryption keys. Analyzed variants establish Windows startup persistence, delete shadow copies and backup catalogs, disable recovery features, and disable the Windows firewall. Phobos samples have also been protected with Rex3Packer, and the Fair variant has used fileless, memory-based delivery.
Phobos historically relied primarily on encryption-based extortion, but affiliates subsequently adopted data theft and double extortion. Associated operations include 8Base and Faust; Faust operators have published stolen data through the 8Base and Space Bears leak sites. Phobos-related intrusions have used tools such as MegaSync to transfer stolen data to external cloud storage. Named variants include Eking, Eight, Elbie, Devos, and Faust. OpcJacker, also described as Phobos Crypter in some reporting, is a separate malware family that has been used to load Phobos.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
8 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
In April 2024, S-RM’s Cyber Threat Intelligence team identified a Faust operator, an affiliate of the Phobos ransomware-as-a-service group, utilising a new leak site, titled ‘Space Bears’, to extort a victim for a ransom payment.
In April 2024, S-RM’s Cyber Threat Intelligence team identified a Faust operator, an affiliate of the Phobos ransomware-as-a-service group, utilising a new leak site, titled ‘Space Bears’, to extort a victim for a ransom payment.
In April 2024, S-RM’s Cyber Threat Intelligence team identified a Faust operator, an affiliate of the Phobos ransomware-as-a-service group, utilising a new leak site, titled ‘Space Bears’, to extort a victim for a ransom payment.
First discovered in March 2022, 8Base is a ransomware group/operation that uses a customized version of Phobos ransomware and steals data prior to encryption.
The Makop ransomware operators started their infamous criminal business in 2020 leveraging a new variant of the notorious Phobos ransomware.
They can also manifest in even more extreme behavior where RaaS affiliates switch to older “fully owned” ransomware payloads like Phobos...
26 distinct techniques documented for this family, organized by ATT&CK tactic.
Threat intelligence lookups for the three additional IP addresses revealed that one—45[.]89[.]127[.]159—was seemingly associated with malware distribution.
The Phobos operators have been selling the ransomware’s multiple variants (e.g., Eking, Eight, Elbie, Devos and Faust) via the ransomware-as-a-service (RaaS) model.
“Dharma, Phobos, and GlobeImposter commonly target small and mid-sized organizations, often through exposed remote desktop services.”
“They use vssadmin.exe and Windows Management Instrumentation command-line utility (WMIC)… [T1047]…”
The ransomware creates a “cmd.exe” process that will execute multiple commands.
Looking at ransomware brands in our dataset from 2020 to 2025, three brands (LockBit, Medusa, Phobos) and one technique (abuse of native BitLocker encryption) have persisted for the duration.
“Dharma, Phobos, and GlobeImposter commonly target small and mid-sized organizations, often through exposed remote desktop services.”
Persistence is achieved by creating an entry under the Run registry key and copying the malware to the Startup folder.
The DuplicateTokenEx API is utilized to create a new access token... The ransomware spawns itself running in the security context of the newly created token.
The DuplicateTokenEx API is utilized to create a new access token that duplicates the token mentioned above... The ransomware spawns itself running in the security context of the newly created token.
Persistence is achieved by creating an entry under the Run registry key and copying the malware to the Startup folder.
The malicious process enables the above privilege via a call to AdjustTokenPrivileges... 'SeDebugPrivilege' privilege
Let's skip the boring details that are the same for every ransomware (anti-debug features, deletion of shadow copies, main disk traversal function, etc).
The DuplicateTokenEx API is utilized to create a new access token... The ransomware spawns itself running in the security context of the newly created token.
The DuplicateTokenEx API is utilized to create a new access token that duplicates the token mentioned above... The ransomware spawns itself running in the security context of the newly created token.
The ransomware tries to open two mutexes called “Global\\<<BID>><Volume serial number>00000001” and “Global\\<<BID>><Volume serial number>00000000”, and then creates them.
Let's skip the boring details that are the same for every ransomware (anti-debug features, deletion of shadow copies, main disk traversal function, etc).
It deletes all Volume Shadow Copies and runs commands to disable the firewall.
CTIR also observed several instances in which adversaries leveraged brute-force attacks against a victim organization’s RDS.
The malware takes a snapshot of all processes in the system... The processes are enumerated using the Process32FirstW and Process32NextW APIs.
The malware extracts the major and minor version numbers of the operating system using the GetVersion method.
The files are enumerated using the FindFirstFileW and FindNextFileW methods.
WNetOpenEnumW is used to start an enumeration of all currently connected resources... The enumeration continues by calling the WNetEnumResourceW function.
Let's skip the boring details that are the same for every ransomware (anti-debug features, deletion of shadow copies, main disk traversal function, etc).
The GetLocaleInfoW function is used to obtain the default locale... The binary verifies whether the 9th bit, which represents Cyrillic alphabets, is cleared.
The attack vectors being leveraged by Phobos distributors are well worn, open or weakly secured RDP ports.
It tries to connect to every host on the network on port 445 in order to encrypt every available network share.
8base sample had been downloaded from the domain admlogs25[.]xyz ... 8base uses SystemBC to encrypt command and control traffic and Smokeloader, which provided initial obfuscation of the ransomware on ingress, unpacking, and loading of the Phobos ransomware.
“Successful data encryption also rose to 56 per cent of attacks” and recovery requires restoring data and systems after ransomware encrypts them.
Any target process is stopped using the TerminateProcess method.
vssadmin delete shadows /all /quiet – delete all Volume Shadow Copies; wmic shadowcopy delete – delete all Volume Shadow Copies | bcdedit /set {default} bootstatuspolicy ignoreallfailures; bcdedit /set {default} recoveryenabled no; wbadmin delete catalog -quiet
17 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
96 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A ransomware family often targeting SMBs through exposed remote desktop services. A free decryptor is available for supported Phobos and 8Base variants.
Phobos is identified in the content as a ransomware family linked to some users of the dismantled First VPN service.
Phobos is described as a ransomware-as-a-service outfit linked to ransomware investigations uncovered through the takedown of First VPN.
A ransomware family referenced via a cracked builder offered on RAMP, lowering the barrier to launching independent ransomware attacks.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.