Poland Arrests Suspected Phobos Ransomware Affiliate in Europol Operation Aether

Polish law enforcement arrested a 47-year-old man in the Małopolska/Lesser Poland region on suspicion of involvement with the Phobos ransomware operation as part of Europol-coordinated Operation Aether targeting Phobos-linked infrastructure and affiliates. During a search of the suspect’s residence, Poland’s Central Bureau/Central Office for Combating Cybercrime (CBZC) seized devices and data investigators said could enable unauthorized access and ransomware activity, including stolen credentials, passwords, credit card numbers, and server IP/access data.

Authorities said technical analysis indicated the seized materials could be used to breach electronic security and support “various attacks, including ransomware,” and alleged the suspect used encrypted messaging to communicate with the Phobos criminal group. Reporting also noted the seizure of a laptop and multiple smartphones, and that the suspect was charged with offenses related to creating/acquiring/sharing tools or data used to unlawfully obtain information and facilitate unauthorized system access; if convicted, he faces up to five years in prison. Operation Aether reporting additionally linked the enforcement activity to efforts against 8Base, described as a ransomware group believed to be connected to Phobos.