Phobos Ransomware Affiliate Arrested by Polish Authorities

Key Findings

Polish authorities have arrested a 47-year-old man accused of being an affiliate for the Phobos ransomware group.
The suspect faces up to five years in prison for producing, obtaining, and sharing computer programs used to conduct cyberattacks.
The arrest was part of a larger Europol-led operation called "Phobos Aetor" that targeted individuals involved with Phobos ransomware attacks.

Phobos ransomware has claimed over 1,000 victims globally and received more than $16 million in extortion payments as of February 2025.
Victims of Phobos attacks include hospitals, schools, non-profit organizations, and a company that contracted with the U.S. Department of Defense.
Malicious activity linked to Phobos significantly declined after the alleged developer and administrator of the ransomware, Russian national Evgenii Ptitsyn, was extradited from South Korea to the U.S. in November 2024.

The 47-year-old suspect was arrested during a raid on his apartment in the Małopolskie province.
Police seized a computer and multiple mobile phones that were used to commit cyberattacks.
Authorities found evidence on the seized devices, including credentials, credit card numbers, and IP addresses for servers that may have been used to conduct various attacks.
The suspect also had tools that could breach servers and used encrypted messaging platforms to communicate with others linked to Phobos.

The arrest was part of the Europol-led "Phobos Aetor" operation, which involved agencies across Europe, Asia, and North America.
Polish officials said they identified the suspect through this coordinated law enforcement effort.
The case is being overseen by the District Prosecutor's Office in Gliwice.

https://cyberscoop.com/phobos-ransomware-affiliate-arrested-poland/
https://securityaffairs.com/188128/cyber-crime/polish-cybercrime-police-arrest-man-linked-to-phobos-ransomware-operation.html