Loading story…
Researchers reported continued evolution of the Phobos ransomware family, highlighting the long-running EKING strain and the emergence of the FAUST variant. Security reporting linked Phobos activity to attacks against public-sector organizations, healthcare entities, and other critical U.S. infrastructure, with defenders publishing detection guidance as operators refined delivery and post-compromise techniques. The reporting indicates that Phobos remains an active ransomware threat with multiple branded variants used to broaden targeting and sustain operations.
Separate threat intelligence described FunkSec as an affiliate-driven, AI-centric ransomware-as-a-service operation that blends hacktivist branding with financially motivated cybercrime. Analysts said the group uses a RaaS model to scale intrusions and extortion, reflecting how modern ransomware actors are combining ideological messaging, affiliate ecosystems, and adaptable tooling. Together, the reporting shows a ransomware landscape in which established families such as Phobos continue to diversify while newer groups like FunkSec industrialize attacks through service-based operations.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Picus Security published analysis characterizing FunkSec's ransomware-as-a-service operations as blending hacktivism and cybercrime. This added a new assessment of the group's operating model and positioning in the threat landscape.
Bitdefender published research describing FunkSec as an AI-centric, affiliate-powered ransomware operation. The report framed FunkSec as a distinct ransomware group with operational characteristics combining AI use and affiliate-driven activity.
SOC Prime reported Phobos ransomware activity affecting the public sector, healthcare, and other critical U.S. infrastructure. The report highlighted active targeting beyond isolated incidents and emphasized detection opportunities for defenders.
Infosecurity Magazine reported that the Phobos ransomware family had expanded with the newly identified FAUST variant. This reflects broader public reporting of the same development after the initial technical disclosure.
FortiGuard Labs disclosed technical details on a Phobos ransomware variant called FAUST, describing it as another active branch of the Phobos family. The report indicates continued evolution of Phobos through newly observed variants.
Fortinet published a deep technical analysis of the EKING variant of Phobos ransomware, documenting its behavior and tooling. This marks an early public technical disclosure about a specific Phobos variant.
6 references tracked. Mallory keeps watching after this page renders.
cybersec.picussecurity.com
Open sourcebitdefender.com
Open sourcesocprime.com
Open sourceinfosecurity-magazine.com
Open sourcefortinet.com
Open sourcefortinet.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Trellix reported on **Phobos**, a ransomware operation that had remained largely under the radar while quietly compromising victims and encrypting systems. The research highlights Phobos as a stealth-focused threat that avoided broad attention despite sustained activity, underscoring how ransomware actors can maintain impact without the visibility associated with larger, more publicized groups. The disclosure brings new attention to Phobos’s tactics and operational footprint, giving defenders a clearer view of a ransomware campaign that had previously received limited scrutiny. For CISOs, the report signals the need to reassess detection coverage for lower-profile ransomware families, especially those that rely on stealth and persistence rather than overt branding or mass publicity.
Jul 12, 2026
Reporting highlights a broader shift in the ransomware ecosystem toward **platform-like operations** and **ransomware-as-a-service (RaaS)** models that lower the barrier to entry and accelerate the creation of new crews. Huntress telemetry for 2025 is cited as placing **Akira** as a leading ransomware group, with operators increasingly targeting the **hypervisor layer** to bypass traditional endpoint controls; separate commentary describes rapid victim growth for **Qilin** (claimed to exceed 1,000 victims in 2025) and notes **LockBit** regaining operational capability after prior disruption. The same reporting also points to “**Extortion-as-a-Service**” offerings (including a federation described as **SLSH**—Scattered Spider/Lapsus$/ShinyHunters) that enable affiliates to rent tooling rather than develop it, contributing to a surge in newly formed groups. A separate technical write-up details **Termite** ransomware as a Babuk-derived operation first observed in late 2024 that has matured into a multi-stage intrusion and **double-extortion** threat, claiming dozens of victims across multiple sectors and regions by March 2026. The report emphasizes Termite’s operationalization of **ClickFix** (browser-based social engineering) to bypass traditional phishing defenses, and provides a distinctive forensic marker: encrypted files reportedly have the Babuk-inherited trailing string `"choung dong looks like hot dog"`, positioned as a practical indicator during triage. Another overview article catalogs major active ransomware groups and tactics, including **Lynx** (described as sharing substantial code with INC, using double extortion, appending `.lynx`, and deleting shadow copies) and **Medusa**, while reiterating law-enforcement attribution and indictments tied to **LockBit** leadership and deployment activity.
Jun 29, 2026
Researchers linked the **8Base** ransomware group to the **Phobos** ransomware-as-a-service ecosystem and mapped a broad infrastructure used to support its campaigns. Analysis tied 8Base activity since at least mid-2023 to custom Phobos branding such as the `.8base` extension, a sharp rise in victim postings, and supporting malware including **SmokeLoader** and **SystemBC**, the latter used as a SOCKS5 proxy to mask command-and-control traffic. A DNS-focused investigation started from 63 indicators tied to an 8Base Phobos campaign and expanded that set to **404 potentially connected web properties**, revealing recurring use of `.pro` domains, many registrations created in 2023, and repeated hosting and geolocation links to Germany, including infrastructure associated with Hetzner Online.
Aug 15, 2026