Phobos Ransomware

BruceRisk, Threat Intelligence

Phobos ransomware is a nasty piece of malware that can encrypt your files, making them inaccessible unless you pay a ransom to the attackers. Here’s a quick rundown of what you need to know:

  • Origin: It emerged in 2018 and is believed to be an evolution of prior ransomware families like Dharma and Crysis.
  • Delivery method: It often exploits weaknesses in Remote Desktop Protocols (RDP) to infect machines. Hackers can buy access to RDP servers on the black market, making this a common attack vector for businesses.
  • Encryption: Once it infiltrates your system, it encrypts your files, rendering them unusable.
  • Demands: After encryption, it delivers a ransom note demanding payment for a decryption key.

Here are some resources for further reading:

  • Avast Business provides a good overview of Phobos ransomware [What is Phobos Ransomware? | Avast Business ON avast.ua]
  • Cybersecurity & Infrastructure Security Agency(CISA) has a detailed technical write-up on Phobos ransomware [Phobos Ransomware]