Phobos
Ransomware-as-a-service operation active since 2019, aimed mainly at small organisations.
Phobos surfaced in a European police case in May 2026, when the Paris prosecutor said the takedown of the criminal service First VPN had yielded evidence for ransomware investigations, citing Phobos as one.
Last refreshed: 12 October 2026 · Appears in 1 active topic
Why does Phobos ransomware keep hitting schools, clinics and small firms?
Timeline for Phobos
Used First VPN to anonymise ransomware gang operations before the takedown
Cybersecurity: Threats and Defences: Saffron raid takes down First VPNBackground
Phobos is a ransomware-as-a-service operation first seen in 2019 and built on code from the older Dharma ransomware family. Its affiliates go after small and medium-sized businesses, local governments, healthcare clinics and schools, organisations that rarely employ their own security Teams. In February 2024 CISA and the FBI published a joint advisory on Phobos, documenting attacks on US healthcare and government bodies and naming weakly protected or compromised Remote Desktop Protocol (RDP) access as the usual way in.
Phobos came up again in the French and Dutch case against First VPN, which police took offline on 19 and 20 May 2026. The Paris prosecutor said that operation had produced evidence for ransomware inquiries and gave Phobos as an example. Europol and Eurojust did not name any ransomware gang as a First VPN customer.
Phobos runs on volume: many victims, modest demands and simultaneous campaigns by separate affiliates. That pattern has kept Phobos a steady mid-tier threat to schools, clinics and local governments while larger crews take the headlines.
What is Phobos ransomware and who does it target?
How does Phobos ransomware encrypt files and demand ransom?
What does Phobos have to do with the First VPN takedown?
Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Updated 12 October 2026. Editorial standards.