The leader of the Phobos ransomware gang pleads guilty before U.S. justice

A 43-year-old Russian citizen, Evgenii Ptitsyn, pleaded guilty before U.S. justice on March 4, 2026, for his key role within the Phobos ransomware gang. Arrested in South Korea in 2024 and later extradited to the United States, he is accused of having developed the malware and then commercialized it to affiliates. He will be sentenced on July 15, 2026. He faces up to 20 years in prison.

According to the indictment, Evgenii Ptitsyn and his accomplices began deploying the Phobos ransomware as early as 2019. In November 2020, the gang adopted a Ransomware-as-a-Service model, with affiliates recruited by Evgenii Ptitsyn on cybercriminal forums. He also managed the group’s dark web site, where data stolen from victims was put up for sale.

Since 2019, the Phobos ransomware and one of its variants, 8Base, have allegedly been used to carry out more than 1,000 attacks worldwide, generating an estimated $16 million (€13.8 million) in illicit profits. Since 2024, U.S. and European authorities have arrested several members of the gang, including a 47-year-old man apprehended in Poland in February 2026.