Phobos Ransomware Analysis

Remote Desktop Protocol (RDP) Exploitation: This is a hallmark of Phobos attacks. Affiliates scan (T1595.001) the internet for systems with exposed RDP ports (typically 3389). They then use brute-force tools (T1110) to crack weak credentials or leverage compromised RDP credentials purchased from underground markets (T1078, T1133). Learn what is brute force.

Phishing Campaigns: Spearphishing emails (T1566.001) with malicious attachments are used. These attachments often contain loaders like SmokeLoader, which, upon user execution (T1204.002), decrypts and deploys the Phobos payload or other malicious tools. SmokeLoader itself uses techniques like manipulating VirtualAlloc/VirtualProtect APIs for process injection and obfuscating C2 traffic by mixing it with requests to legitimate websites.

Using Windows Command Shell (T1059.003) or PowerShell (T1059.001) for execution.

Deploying payloads using executables sometimes named deceptively (e.g., mimicking system processes).

Leveraging Windows API functions (T1106) to steal access tokens (T1134.001, T1134.002 leveraging SeDebugPrivilege) or bypass User Account Control (UAC) to gain administrative rights.

Employing Process Injection (T1055) techniques, sometimes via loaders like SmokeLoader.

Disabling Security Software: Using tools like Process Hacker or PowerTool (T1562) to terminate antivirus and EDR processes. Disabling system firewalls via commands like netsh firewall set opmode mode=disable (T1562.004).

Deleting Volume Shadow Copies: Executing commands like vssadmin.exe delete shadows /all /quiet or using WMI (T1047) to prevent restoration from backups (T1490).

Obfuscation: Payloads may be packed or obfuscated. Loaders like SmokeLoader employ multi-stage unpacking and API manipulation. Learn about CyberChef, the cyber swiss army knife for security analysts.

Creating entries in Registry Run keys or placing executables in Startup folders (T1547.001).

Installing legitimate remote access tools like AnyDesk (T1219) for persistent C2.

Using tools like Mimikatz to dump credentials from memory (LSASS) (T1003.001).

Extracting passwords from browsers or other software (T1555.003) using tools like NirSoft's Remote Desktop Passview.

Accessing cached password hashes (T1003.005).

Enumerating Active Directory objects (T1087.002) using tools like Bloodhound and Sharphound.

Discovering network shares (T1135), system information (T1082), running processes (T1057), and user files (T1083).

Using stolen credentials to access other systems via RDP (T1021.001) or SMB/Windows Admin Shares (T1021.002).

Leveraging frameworks like Cobalt Strike for post-exploitation activities.

Identifying and archiving sensitive data (legal, financial, technical documents, password databases - T1555.005) into .rar or .zip files (T1560).

Using tools like WinSCP (T1071.002) or cloud storage services like Mega.io (T1567.002) to exfiltrate data (T1048).

Using established C2 frameworks like Cobalt Strike.

SmokeLoader communicates via HTTP/HTTPS, often obfuscated.

Actors may use legitimate remote access tools (T1219) or standard protocols like FTP for data transfer (T1071.002).

Initial communication with victims often uses standard email, but operators might use ICQ, Jabber, or QQ (T1585 - Infrastructure Acquisition).

Data Encryption (T1486): Encrypting files on all accessible logical drives and network shares. Phobos typically uses a hybrid approach (e.g., AES-256 for file encryption, RSA-1024 to protect the AES key). Encrypted files are renamed, often appending a unique ID, an affiliate email address, and a specific extension (e.g., .phobos, .faust, .eking, .devos, .acute).

Inhibit System Recovery (T1490): Deleting backups and shadow copies.

Extortion (T1657): Dropping ransom notes (commonly info.txt and info.hta) containing instructions, a unique victim ID, and contact email addresses or links to TOR-based negotiation sites. Threats often include leaking exfiltrated data if the ransom isn't paid. Communication may escalate to voice calls in some cases.

Target Industries: While technically capable of hitting any sector, Phobos attacks have disproportionately impacted:

Geographic Focus: Phobos attacks have been observed globally, but a significant concentration of victims, particularly in later stages (e.g., 2023-2024), has been reported in the United States. Other affected regions include Europe, Canada, and parts of Asia and the Middle East.

Potential Impact:

Ongoing Activity (2019-Present): Since its emergence, Phobos has been consistently used in attacks worldwide, particularly against the sectors mentioned above. Its reliance on easily exploitable RDP makes it a persistent threat.

FAUST Variant Campaign (2023-2024): Security researchers analyzed campaigns using the .faust extension variant. These attacks often started with malicious Office documents (XLAM) delivering PowerShell downloaders hosted on platforms like Gitea, eventually leading to the deployment of the FAUST payload. This campaign highlighted the use of multi-stage downloads and process injection techniques.

8Base Affiliate Activity: The group known as 8Base emerged as a significant ransomware actor in 2023, utilizing a customized version of Phobos. They were highly active, targeting a wide range of industries, and employed double extortion tactics with a dedicated leak site. Their activity peaked and then reportedly declined sharply in 2024.

Law Enforcement Actions (2024): Coordinated international efforts involving the FBI, Europol, and other national agencies led to the arrest and indictment of several individuals alleged to be key figures or affiliates in Phobos/8Base operations (e.g., Roman Berezhnoy, Egor Nikolaevich Glebov, Evgenii Ptitsyn). These actions also involved disrupting server infrastructure used by the affiliates, contributing to a reported decrease in Phobos activity. Sanctions were also levied against infrastructure providers like Zservers, implicated in supporting ransomware groups.

Opportunistic Builders (Post-Decline): Following the reported decline and arrests, threat actors were observed advertising Phobos ransomware builders on underground forums (like RAMP), attempting to capitalize on the existing codebase and reputation, indicating the potential for the threat to persist through different channels.

Audit and Limit RDP: Inventory all systems using RDP. Disable it if not essential. Place necessary RDP access behind a secure VPN or Zero Trust Network Access (ZTNA) solution.

Strong Authentication: Enforce strong, unique passwords for all accounts, especially those used for RDP. Implement Multi-Factor Authentication (MFA) for all remote access, administrative accounts, and critical services. Read about passwordless authentication.

Account Lockouts: Configure account lockout policies after a specified number of failed login attempts to deter brute-force attacks.

Logging and Monitoring: Enable and monitor RDP login attempts, investigating any suspicious activity.

Principle of Least Privilege: Ensure users and administrators only have access necessary for their roles. Audit administrative accounts regularly.

Time-Based Access: Use time-based access controls for administrative accounts (e.g., Privileged Access Management - PAM solutions).

Credential Protection: Avoid storing passwords in plaintext, especially in scripts. Use Windows Credential Guard and ensure the Protected Users group is utilized for high-privilege accounts.

Endpoint Detection and Response (EDR): Deploy EDR solutions for advanced threat detection, investigation, and response capabilities beyond traditional antivirus.

Antivirus Software: Keep AV signatures and engines up-to-date. Configure regular scans.

Application Allowlisting: Implement controls to restrict software execution to only authorized applications.

Disable Scripting: Restrict or disable command-line and scripting languages (like PowerShell) for standard users where possible, using constrained language mode or execution policies.

Network Segmentation: Segment networks to limit the blast radius of an infection. Prevent lateral movement between critical segments.

Firewall Configuration: Ensure firewalls are properly configured to block unnecessary ports and protocols. Disable unused ports/protocols on endpoints.

User Training: Educate users on recognizing phishing emails, malicious attachments, and social engineering tactics. What is phishing simulation and why it is important for an organization?

Email Security: Implement email filtering solutions. Add banners to emails originating from external sources. Consider disabling hyperlinks in emails from external senders.

Regular Backups: Implement a robust backup strategy (e.g., 3-2-1 rule: 3 copies, 2 different media, 1 offsite/offline).

Offline and Immutable Backups: Ensure backups are stored offline or are immutable (cannot be altered or deleted by ransomware).

Test Backups: Regularly test backup restoration procedures to ensure they work correctly and efficiently.

Keep operating systems, software, and firmware up-to-date with the latest security patches to address known vulnerabilities. Create a patch management strategy.

Log Collection: Implement comprehensive logging across endpoints, servers, and network devices. Centralize logs in a SIEM for analysis and correlation. Splunk is security information and event management.

Network Monitoring: Use network intrusion detection/prevention systems (IDPS) and monitor network traffic for anomalies.

Incident Response Plan: Develop and regularly test an incident response plan specifically addressing ransomware scenarios.

Validate Controls: Regularly test security controls against known Phobos TTPs (using frameworks like MITRE ATT&CK) to ensure effectiveness.

Report suspected ransomware incidents immediately to CISA (report@cisa.gov), the FBI (via local field office or IC3.gov), or the MS-ISAC. Provide detailed information as requested. Paying ransoms is discouraged as it does not guarantee data recovery and fuels the ransomware ecosystem.

Rhysida Ransomware

LockBit 3.0 Ransomware

CLOP Ransomware

BlackCat (ALPHV)

Black Basta Ransomware