Global Crackdown: Four Suspected 8base Ransomware Operators Arrested by Authorities

A significant global law enforcement initiative has resulted in the arrest of four Russian nationals accused of participating in over 1,000 ransomware attacks around the world. This operation, named Phobos Aetor, highlights the ongoing battle against cybercrime and the intricate networks behind ransomware operations.

Details of the Phobos Aetor Operation

The operation took place in Phuket, Thailand, and was led by Bavarian police. The arrested individuals are believed to be affiliated with the 8base ransomware group, which is recognized as the largest affiliate of the notorious Phobos ransomware-as-a-service operation.

Connection to 8base Ransomware Group

The Phobos ransomware has long been associated with the 8base data extortion gang. As part of the operation, authorities successfully seized the group’s dark web leak site, which has been a key asset in their criminal activities.

Charges Filed Against Suspects

On Wednesday, the Justice Department unsealed charges against two of the suspects:

• Roman Berezhnoy, 33
• Egor Nikolaevich Glebov, 39

These individuals are accused of running the 8base ransomware affiliate that targeted both public and private organizations through the deployment of Phobos ransomware.

Impact on Critical Infrastructure

The FBI issued warnings last year regarding the use of Phobos in attacks against local governments, emergency services, public healthcare, and other vital infrastructure across the United States. According to Europol, the 8base group not only utilized Phobos in its operations but also exploited its infrastructure to create their own variant of the ransomware.

Financial Gains from Ransomware Attacks

The four suspects are alleged to have generated approximately $16 million through their ransomware schemes, which included targeting 17 organizations in Switzerland.

Evidence Seized and Ongoing Investigations

Authorities have confiscated more than 40 pieces of evidence, such as mobile phones, laptops, and digital wallets, and dismantled over 100 servers linked to the criminal network. The Justice Department reports that more than 400 companies were warned about “ongoing or imminent ransomware attacks” as part of this operation.

Previous Arrests in the Phobos Network

Last year, the U.S. government successfully extradited an alleged Russian hacker believed to be a vital administrator of the prolific Phobos ransomware operation. In 2023, another affiliate of Phobos was apprehended in Italy based on a French arrest warrant.

For more information on cybersecurity and ransomware prevention, visit CISA or check out our cybersecurity tips page.