Phobos Ransomware Administrator Evgenii Ptitsyn Pleads Guilty in U.S. Case

U.S. prosecutors said Evgenii Ptitsyn, a 43-year-old Russian national described as an administrator/leader behind the Phobos ransomware operation, pleaded guilty to wire fraud conspiracy tied to a global ransomware-and-extortion scheme. Court filings and DOJ statements cited in reporting say Phobos and its affiliates victimized more than 1,000 organizations worldwide and extorted over $39 million, with victims including U.S. healthcare providers, hospitals, educational institutions, and other essential services. Ptitsyn was arrested in South Korea and later extradited to the United States; he faces a maximum of 20 years in prison.

Authorities described Phobos as an affiliate-driven operation in which administrators developed and distributed the ransomware, coordinated sales via a darknet site, and advertised services on criminal forums/messaging platforms, while affiliates typically gained access to victim networks—often using stolen credentials—to steal and encrypt data and then demand payment for decryption. Reporting also described a fee/revenue model in which affiliates paid administrators for unique decryption keys and administrators took a cut of proceeds; Ptitsyn agreed to forfeit $1.77 million and pay at least $39.3 million in restitution. Additional context in coverage linked Phobos to related activity (including the 8Base strain) and noted prior law-enforcement actions against other alleged members, as well as the release of a free Phobos decryption tool by Japanese authorities.