Ransomware: Russian Phobos Affiliate Appears Before a French Court
A Russian affiliate of the Phobos ransomware gang appeared on 11 February 2026 before the 13th Criminal Chamber of the Paris Judicial Court, alongside his partner. Law enforcement authorities arrested them in Milan in August 2023. He is accused of having targeted 65 organizations in France, resulting in total damages estimated at €900,000. His partner allegedly assisted him in laundering the proceeds of his criminal activities.
Documents found on a USB drive belonging to the suspect listed around ten attacks carried out since 2016 using the CrypotMix and later Phobos ransomware strains. The drive also contained access credentials to Phobos’s affiliate service, the gang’s malware tools, and user instructions. The latter notably prohibited attacks against Russian organizations or entities located in the former Soviet sphere.
Exchanges with an individual known as “Syndicate,” believed to be the main operator behind Phobos, suggest that he retained 30% of the ransom payments. Conversations with a money launderer indicate that the suspect handled over a ten-year period 284 bitcoins (€11 million), 63 million rubles (€690,000), and $185,000 (€156,000). However, only one French victim ultimately paid a ransom.
The court is expected to deliver its verdict on 19 February 2026.