PHOBOS
Attribution profile
- Type
- Crime Syndicate
- Location
- Russia
- Known incidents
- 3 incidents
- Sources
- 2 sources
- First seen
- 2021-07-24
- Last seen
- 2024-08-12
- Updated
- 2026-10-13 07:23
- Aliases
- 1 alias
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
PHOBOS, also known as the Phobos gang, is a ransomware threat actor believed to operate from Russia. The group has targeted municipal administrations in Brazil, Italian corporate firms providing tax and financial management software, and Romanian healthcare institutions, seeking financial gain through bitcoin ransom demands. Its observed tactics include deploying the Phobos ransomware family—notably the Faust variant in a 2024 attack—and gaining initial access via exposed Remote Desktop Protocol connections, as seen in the 2021 hospital intrusion. No public linkage to a state sponsor or criminal consortium has been established. Representative operations comprise the ransomware disruption of Itu’s municipal services in August 2024, the intrusion against Advanced Systems in December 2022, and the encryption of Clinical Hospital No. 1 CF Witting in Bucharest in July 2024.
Incidents
Attributed incidents are available to members.
3 incidentsSources
Sources available to members: 2 sources.