Forest Global Training Partners

Cyber Risks · Cisco Talos

Understanding the Phobos affiliate structure and activity

Summary: Cisco Talos analyzed five of the most prolific Phobos ransomware variants, finding identical source code across samples with differences limited to configuration settings, contact email addresses, and ransom notes. In an early 2023 intrusion tied to the "Elbie" variant, attackers compromised an Exchange server, moved laterally to backup, database, and hypervisor hosts, cleared Windows event logs, deleted volume shadow copies, enabled RDP, and attempted to uninstall endpoint protection before deploying the ransomware. Talos assesses with moderate confidence that multiple threat actors operate behind each variant, and that a single actor controls the private RSA key since every sample analyzed contains the same public key.

Bottom line: Every Phobos sample Talos analyzed carries the same public RSA key, meaning one party holds the only private key capable of decryption - so affiliates, and by extension victims, are dependent on a single central authority. The Elbie intrusion targeted backup servers, database servers, and hypervisor hosts individually rather than spraying ransomware broadly, a pattern Talos attributes to affiliates going after high-value servers to raise the odds of a payout.

Read the original at Cisco Talos ↗

Topics
Malware
Related