Phobos

Phobos is a ransomware-as-a-service group that emerged in 2019, widely believed to be a derivative of Dharma ransomware, sharing code lineage and operational patterns. Phobos targets small and medium enterprises, local governments, healthcare clinics and schools, sectors with limited in-house security capability and high operational dependency on accessible data. Unlike high-profile groups that chase large ransoms from enterprise targets, Phobos affiliates run a high-volume, lower-ransom model, charging hundreds to tens of thousands of dollars per victim and operating numerous simultaneous campaigns. The US Cybersecurity and Infrastructure Security Agency (CISA), FBI and HHS issued a joint advisory on Phobos in February 2024, documenting its systematic targeting of US healthcare and government entities and its use of compromised Remote Desktop Protocol (RDP) access as the primary initial access vector.

Phobos was one of at least 25 ransomware gangs named by Europol as users of First VPN, the criminal anonymisation service dismantled in Operation Saffron on 21 May 2026. The seizure of 33 servers across 27 countries stripped Phobos and co-dependent gangs of a shared operational-security layer used to mask command-and-control and victim-communication traffic. Based on prior takedown timelines (VPNLab.net reconstituted affiliates within two to four weeks), Phobos operations face a temporary disruption while affiliates migrate to alternative bulletproof hosts rather than a permanent shutdown.

Phobos does not operate a public leak site, distinguishing it from double-extortion groups that use public data publication as leverage. Its sustained volume against under-resourced targets makes it a persistent mid-tier threat even as higher-profile groups dominate ransomware headlines. The Operation Saffron disruption may temporarily reduce campaign frequency and introduce operational-security errors during the infrastructure transition period, creating a short window for remediation at previously targeted organisations.