Bleepingcomputer

Poland Arrests Suspect Linked to Phobos Ransomware Operation

First seen 17 Feb 2026, 12:10 UTC • Feeds2.Feedburner

+3 •89% similarity •45.9

Ask AI about this cluster

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

Polish police have arrested a 47-year-old man suspected of involvement with the Phobos ransomware group. The suspect was detained in the Małopolska region, and law enforcement seized computers and mobile devices containing stolen credentials and sensitive data. This operation is part of a larger international initiative coordinated by Europol.

ThreatCluster AI

Timeline

2026-02-17

Suspect arrested in Poland linked to Phobos ransomware

2026-02-17

Computers and mobile phones seized during the arrest

Date unknown

Operation Aether initiated targeting Phobos group

Attack Flow

7 entities, 12 inferred relationships (STIX 2.1).

Technique (2)

Ransomware
T1486 - Data Encrypted for Impact

Campaign (2)

Operation Aether
Phobos Aetor

Malware (1)

Phobos

Threat Actor (2)

8Base
Crysis

Relationships

8Base uses Phobos
Crysis uses Phobos
8Base uses Ransomware
8Base uses T1486 - Data Encrypted for Impact
Crysis uses Ransomware
Crysis uses T1486 - Data Encrypted for Impact
Operation Aether attributed to 8Base
Operation Aether attributed to Crysis
Phobos Aetor attributed to 8Base
Phobos Aetor attributed to Crysis
Operation Aether uses Phobos
Phobos Aetor uses Phobos

Community

Browse all →

Tracked Entities in This Story

8Base Crysis Phobos Operation Aether Phobos Aetor Ransomware

Poland Arrests Suspect Linked to Phobos Ransomware Operation

Ask AI about this cluster

Article Content

Timeline

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Community

Continue Reading

Tracked Entities in This Story