PhobosMalware
- java notdharma
MalwareBytes states that Phobos is one of the ransomware families that are distributed via hacked Remote Desktop (RDP) connections. This isn't surprising, as hacked RDP servers are a cheap commodity on the underground market, and can make for an attractive and cost efficient dissemination vector for threat groups.From MISP Galaxy
Last reported 23 days ago, by ESET WeLiveSecurity (ES)5 reports
ATT&CK techniques
6 of 24 · each with the sentence it comes from- T1550.002Pass the Hash
“The credentials can be usernames and passwords and also usernames and password hashes (T1550.002) which are usually retrieved by threat actors through LSASS Dump (T1003.001) during the intrusions.”
- T1003.001LSASS Memory
“…ames and passwords and also usernames and password hashes (T1550.002) which are usually retrieved by threat actors through LSASS Dump (T1003.001) during the intrusions.”
- T1012Query Registry
“…, the malware performs account discovery (T1087), process discovery (T1057), file and directory discovery (T1083), and registry queries (T1012) to map the environment and identify high-value targets for encryption and exfiltration.”
- T1053.005Scheduled Task
“In the following image, there can be seen two procedures: the first guides the threat actors to create a scheduled task to execute the ransomware in the Netlogon folder by using Windows cmd; whereas the second guides the threat actors to place the ransomware in the Netlogon folde…”
- T1057Process Discovery
“Once running with elevated privileges, the malware performs account discovery (T1087), process discovery (T1057), file and directory discovery (T1083), and registry queries (T1012) to map the environment and identify high-value targets for encryption and exfiltration.”
- T1059.001PowerShell
“The use of PowerShell is consistent with the MITRE ATT&CK technique T1059.001, though NCERT mapped to T1059.003 for this campaign.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
5 reports, newest first · the exact sentence from each-
Panorama de ciberamenazas en América Latina: balance del primer semestre de 2026“Presencia de células selectivas: Operaciones vinculadas a BlackMatter, Conti, Phobos, Akira, DragonForce y muestras residuales de LockBit o WannaCry se manifestaron mediante incidentes puntuales.”
-
Dark Web Profile: Blue Locker Ransomware“Phobos “Blue”: an unrelated Phobos-family variant.”
-
Panorama de amenazas digitales en México: qué cambió en el primer semestre de 2026“…cute;as, células vinculadas a Conti y Qilin encabezaron la actividad identificada en el país, seguidas por operadores como Phobos, Babyk y BlackMatter.”
-
Time to Ransom is Money“…ome threat actors, including Play, Akira, and Dharma/Crysis, and longer times from others, including (ironically) Rapid, Sodinokibi, and Phobos.”
-
Ransomware debris: an analysis of the RansomHub operation“In just the first quarter of 2025 many things have already happened, including the arrest of individuals tied to Phobos ransomware, 8Base and Affiliate 2803 groups, data leaks of Black Basta‘s Matrix server and Medialand bullet proof server as well as the downtime of RansomHub in…”
Indicators in its reports
named in the reports above- protonmail[.]comin 1 report
- d3cc6cc4538d57f2…377cf1d0fadcin 1 report
- e6bd4ed287d13362…96d5d9e95a33in 1 report
- 6eeb20cc709a18bf…244886bbfd2ein 1 report
- 515bd71a8b3c2bce…dcdcb8a91ed9in 1 report
- 6af349a30f95e01b87cd7dd4ddc8e3fein 1 report
- 7e1cc4d2e4b35b95…4b6f7f2783d1in 1 report
- xmpp[.]jpin 1 report
- shinra-encrypt-support[.]xyzin 1 report
- blue-decryptor[.]sitein 1 report
- backup-leaks[.]funin 1 report
- 185.225.69[.]140in 1 report
- 195.3.145[.]99in 1 report
- 91.243.113[.]21in 1 report
- 103.150.199[.]23in 1 report
- 185.180.197[.]34in 1 report
- 45.155.205[.]233in 1 report
- 84.54.52[.]83in 1 report
- 185.212.128[.]88in 1 report
- 176.123.2[.]209in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.