Phobos Ransomware Administrator Evgenii Ptitsyn Pleads Guilty in U.S. Case
U.S. prosecutors said Evgenii Ptitsyn, a 43-year-old Russian national described as an administrator/leader behind the Phobos ransomware operation, pleaded guilty to wire fraud conspiracy tied to a global ransomware-and-extortion scheme. Court filings and DOJ statements cited in reporting say Phobos and its affiliates victimized more than 1,000 organizations worldwide and extorted over $39 million, with victims including U.S. healthcare providers, hospitals, educational institutions, and other essential services. Ptitsyn was arrested in South Korea and later extradited to the United States; he faces a maximum of 20 years in prison.
Authorities described Phobos as an affiliate-driven operation in which administrators developed and distributed the ransomware, coordinated sales via a darknet site, and advertised services on criminal forums/messaging platforms, while affiliates typically gained access to victim networks—often using stolen credentials—to steal and encrypt data and then demand payment for decryption. Reporting also described a fee/revenue model in which affiliates paid administrators for unique decryption keys and administrators took a cut of proceeds; Ptitsyn agreed to forfeit $1.77 million and pay at least $39.3 million in restitution. Additional context in coverage linked Phobos to related activity (including the 8Base strain) and noted prior law-enforcement actions against other alleged members, as well as the release of a free Phobos decryption tool by Japanese authorities.
Timeline
Jul 15, 2026
Sentencing scheduled for July 15
Following the guilty plea, the court scheduled Ptitsyn's sentencing for July 15, where he faces a maximum sentence of 20 years in prison.
Mar 4, 2026
Plea deal includes forfeiture and restitution terms
Under the plea agreement, prosecutors dropped several charges, while Ptitsyn agreed to forfeit about $1.77 million and pay at least $39.3 million in restitution.
Mar 4, 2026
Ptitsyn pleads guilty to wire fraud conspiracy
In U.S. federal court, Ptitsyn pleaded guilty to wire fraud conspiracy for his role in administering the Phobos ransomware scheme. Prosecutors said the operation used affiliates, stolen credentials, darknet infrastructure, and cryptocurrency payments to extort victims.
Nov 1, 2024
Ptitsyn extradited from South Korea to the U.S.
After his arrest, Ptitsyn was extradited from South Korea to the United States in November 2024, according to most reports, to face federal charges related to Phobos.
May 1, 2024
South Korea arrests Evgenii Ptitsyn
Ptitsyn was arrested in South Korea in May 2024 as part of the international law-enforcement case targeting the Phobos ransomware operation.
Jan 1, 2023
California school system pays $300,000 ransom
One disclosed victim example was a California public school system that paid a $300,000 ransom in 2023 following a Phobos attack.
Jan 1, 2022
Phobos extorts over 1,000 victims worldwide
Authorities said Phobos and its affiliates went on to compromise more than 1,000 organizations globally, including many U.S. healthcare, education, and essential-service entities, collecting more than $39 million in ransom payments.
Jan 1, 2022
Ptitsyn takes leadership role in Phobos
Court records cited by multiple reports say Evgenii Ptitsyn assumed a leadership role in the Phobos ransomware operation in January 2022, overseeing distribution and affiliate coordination.
Nov 1, 2020
Phobos ransomware activity begins
Prosecutors said Phobos ransomware activity began by November 2020, with the operation later growing into a global affiliate-based extortion scheme.
See the full picture in Mallory
Mallory subscribers get deeper analysis on every story, including:
Who’s affected and how
Deep-dive technical analysis
Actionable next steps for your team
IPs, domains, hashes, and more
Ask questions and take action on every story
Filter by topic, classification, timeframe
Get matching stories delivered automatically
Sources
Related Stories
Guilty Pleas in Major Cyber-Enabled Fraud and Ransomware Operations
U.S. authorities secured guilty pleas in two separate cyber-enabled criminal cases: a Ghana-based fraud ring that stole more than **$100 million** via **business email compromise (BEC)** and romance scams, and a **Phobos** ransomware administrator tied to a global extortion operation. The cases highlight parallel monetization paths—social engineering and payment redirection in BEC/romance schemes versus data encryption and extortion in ransomware-as-a-service (RaaS)—and both involve international arrests/extraditions to the United States. In the fraud case, **Derrick Van Yeboah** (40) pleaded guilty to conspiracy to commit wire fraud and agreed to pay **over $10 million** in restitution for his role in a Ghana-based operation that targeted U.S. victims from 2016 to May 2023, using spoofed emails to impersonate customers/employees and laundering proceeds through U.S. intermediaries before sending funds to coordinators in West Africa. Separately, **Evgenii Ptitsyn** (43) pleaded guilty to wire fraud conspiracy for helping develop, sell, distribute, and operate the **Phobos** ransomware platform, which the U.S. DoJ says hit **1,000+** entities and extorted **$16+ million**; he was arrested in South Korea in 2024, extradited to the U.S., and faces up to **20 years** in prison, with sentencing scheduled for July 15.
1 months ago
Poland Arrests Suspected Phobos Ransomware Affiliate in Europol Operation Aether
Polish law enforcement arrested a **47-year-old man** in the Małopolska/Lesser Poland region on suspicion of involvement with the **Phobos ransomware** operation as part of **Europol-coordinated Operation Aether** targeting Phobos-linked infrastructure and affiliates. During a search of the suspect’s residence, Poland’s Central Bureau/Central Office for Combating Cybercrime (**CBZC**) seized devices and data investigators said could enable unauthorized access and ransomware activity, including **stolen credentials**, **passwords**, **credit card numbers**, and **server IP/access data**. Authorities said technical analysis indicated the seized materials could be used to breach electronic security and support “various attacks, including ransomware,” and alleged the suspect used **encrypted messaging** to communicate with the Phobos criminal group. Reporting also noted the seizure of a laptop and multiple smartphones, and that the suspect was charged with offenses related to creating/acquiring/sharing tools or data used to unlawfully obtain information and facilitate unauthorized system access; if convicted, he faces up to **five years** in prison. Operation Aether reporting additionally linked the enforcement activity to efforts against **8Base**, described as a ransomware group believed to be connected to Phobos.
1 months ago
Guilty Plea of Ukrainian National for Nefilim Ransomware Attacks
Artem Aleksandrovych Stryzhak, a Ukrainian national, pleaded guilty to conspiracy to commit computer fraud for his role in deploying Nefilim ransomware against high-revenue companies in the United States and other countries. Stryzhak and his co-conspirators generated unique ransomware executables, decryption keys, and ransom notes for each victim, targeting organizations with annual revenues exceeding $100 million and threatening to publish stolen data unless ransoms were paid. He was arrested in Spain in June 2024 and extradited to the United States, where he faces up to 10 years in prison. Authorities are still seeking his alleged co-conspirator, Volodymyr Tymoshchuk, and have announced an $11 million reward for information leading to his arrest or conviction. The Nefilim ransomware group, for which Stryzhak operated, caused millions of dollars in losses through extortion payments and damage to victim networks. The group primarily targeted companies in the United States, Canada, and Australia, conducting research on potential victims to maximize the impact of their attacks. The U.S. Department of Justice highlighted the international scope of the operation and the significant financial and reputational harm inflicted on victim organizations. Stryzhak’s guilty plea marks a significant development in ongoing efforts to disrupt major ransomware operations and bring perpetrators to justice.
1 months ago