Phobos Ransomware Decryption & Data Recovery

Phobos emerged in late 2018, closely resembling Crysis/Dharma in ransom-note style and operating model, and was then rented to affiliates as a service. That produced a long list of same-lineage variants: Eking, Faust, Elbie, Eight, Devos, Backmydata, 8Base and others. CISA issued a dedicated #StopRansomware advisory (AA24-060A) in February 2024, identifying Phobos as a sustained threat to government bodies and smaller enterprises; at the operator's March 2026 guilty plea, US court filings put the lineage's ransom takings at more than USD 39 million from over 1,000 entities.

China context: Phobos generates one of the highest volumes of decryption requests in China. Across several 2025 landscape reports, 360 identified it as the family with the largest number of decrypted files, and its infection volume stays near the top. The reason is straightforward: it targets small and mid-sized business servers exposing port 3389 with weak credentials, and such assets are extremely common domestically. Since the July 2025 decryptor release it has become one of the few high-prevalence families with a genuine official decryption path, though attacks continue.

The filename pattern is the most reliable Phobos indicator: originalname.originalext.id[8-char volume serial-4 digits].[attacker email].variant extension — for example report.xlsx.id[A1B2C3D4-3483].[xxx@onionmail.org].faust. Older builds used an uppercase ID with 8 characters; newer builds use lowercase "id" and append 4 fixed digits.

Common variant extensions: .phobos, .eking, .faust, .elbie, .eight, .devos, .backmydata, .LIZARD, .2700, .help. Extensions rotate frequently, so an unfamiliar suffix on a filename matching the pattern above is almost certainly Phobos lineage.

Ransom notes: info.txt and info.hta are dropped together, and info.hta pops up automatically once encryption completes, listing two anonymous mailboxes and asking the victim to quote their ID.

Other signs: database and backup services forcibly terminated; volume shadow copies deleted; firewall rules modified to keep RDP reachable; and several servers in the same segment encrypted within a short window, indicating hands-on lateral movement.

Brute-forced RDP dominates. The CISA advisory and vendor analyses describe the same affiliate workflow: scan the internet for open port 3389, run open-source brute-force tooling against common usernames and passwords, then reuse the credential or escalate locally and move sideways. In Chinese cases the script is almost invariable — a server with 3389 mapped straight to the internet and a weak administrator password.

Other entry points include phishing loaders followed by hands-on operation, leaked or reused VPN and remote-management credentials, database port brute-forcing on MS SQL or MySQL followed by command execution through stored procedures, and shared unaudited accounts on outsourced maintenance channels.

Inside the network, operators dump credentials, distribute the payload via SMB shares and scheduled tasks, and hunt for backup directories and mapped NAS drives. Lateral movement is less sophisticated than LockBit's, but because victim networks are flat and unsegmented the blast radius still covers the whole business network.

Phobos encrypts file contents with AES-256 and protects the symmetric key with RSA-1024, generating key material per host.

Size-based partial encryption is a technically important trait: the CISA advisory states that files below 1.5 MB are fully encrypted while files above that threshold are only partially encrypted, to improve speed. This matters for recovery — SQL Server .mdf files, Oracle .dbf files, large archives and virtual disks all sit far above 1.5 MB and usually retain a meaningful proportion of intact blocks.

Destructive and evasive behaviour: deletes volume shadow copies and disables Windows recovery and automatic repair; terminates database, mail and backup-agent services to release file locks before encrypting; modifies firewall rules to keep the attacker's remote access open; encrypts local disks, mapped network drives and reachable SMB shares, which is why NAS devices and file servers are commonly hit; then writes info.txt and info.hta and displays the pop-up note. Phobos targets Windows, with no mature native Linux or ESXi payload observed.