U.S. cybersecurity and intelligence agencies, including CISA, the FBI, and MS-ISAC, have issued warnings about Phobos ransomware attacks aimed at government and critical infrastructure. Phobos operates under a ransomware-as-a-service (RaaS) model and has targeted various sectors, including municipal and county governments, emergency services, education, public healthcare, and critical infrastructure, leading to several million dollars in ransoms. Phobos has been active since May 2019, with variants like Eking, Eight, Elbie, Devos, Faust, and Backmydata. It is believed to be managed by a central authority with control over the ransomware’s private decryption key. Associated attacks have typically used phishing to drop pay loads like SmokeLoader or brute-force attacks on exposed RDP services for initial access. Once inside, attackers use additional tools and techniques to maintain persistence, steal credentials, and escalate privileges. The threat actors utilize tools like Bloodhound and Sharphound for enumeration of the active directory and WinSCP and Mega.io for data exfiltration, often followed by the deletion of volume shadow copies which makes recovery more difficult. Process injection techniques are often used to further execute code and evade detection, while modifications to the Windows Registry have been used for persistence. Additionally, Phobos actors’ use built-in Windows APIs to steal tokens, bypass access controls, and escalate privileges via the SeDebugPrivilege process. CTIX analysts will keep an eye on activity related to Phobos ransomware actors and ransomware attacks.