Evgenii Ptitsyn, a Russian national suspected of being an administrator of the Phobos ransomware operation, has been extradited from South Korea to face charges in the United States. Phobos, a ransomware-as-a-service (RaaS) model derived from the Crysis ransomware family, has been responsible for attacks on over one thousand (1,000) entities globally, resulting in over $16 million in ransom payments. The operation involved selling access to ransomware payloads on the dark web, with targets including schools, hospitals, and small businesses. Ptitsyn, allegedly using the online aliases “derxan” and “zimmermanx,” is charged with wire fraud, conspiracy to commit computer fraud, and extortion related to hacking. Each ransomware deployment was uniquely identified, linking it to corresponding decryption keys and payments directed to specific cryptocurrency wallets. From December 2021 to April 2024, decryption fees collected by affiliates were transferred to a wallet controlled by Ptitsyn. If convicted, he faces significant prison sentences up to twenty (20) years for each wire fraud count, ten (10) years for each hacking count, and five (5) years for conspiracy charges. Phobos affiliates often utilized “spray and pray” tactics, aiming ransomware at numerous potential targets in hopes of infection. Their ransom demands were relatively small, often under $2,000, increasing the likelihood of payment. Despite the lower technical proficiency of affiliates compared to other ransomware groups, Phobos maintained a structured operation, closely monitoring affiliate performance. Recent trends point to law enforcement efforts prioritizing dismantling ransomware networks. The reduction in Phobos activity following Ptitsyn’s arrest suggests a direct impact on the group’s operations, signaling progress in curbing such cyber threats.