#StopRansomware: Phobos Ransomware

Text acquired from the source

Cybersecurity Advisory #StopRansomware: Phobos Ransomware Last Revised February 29, 2024 Alert Code AA24-060A Related topics: Cyber Threats and Response , Malware, Phishing, and Ransomware , Incident Response Actions to take today to mitigate Phobos ransomware activity: Secure RDP ports to prevent threat actors from abusing and leveraging RDP tools. Implement EDR solutions to disrupt threat actor memory allocation techniques. Implement EDR solutions to disrupt threat actor memory allocation techniques. SUMMARY Note: This joint Cybersecurity Advisory (CSA) is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations protect against ransomware. Visit stopransomware.gov to see all #StopRansomware advisories and to learn more about other ransomware threats and no-cost resources. The Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), and the Multi-State Information Sharing and Analysis Center (MS-ISAC) are releasing this joint CSA, to disseminate known TTPs and IOCs associated with the Phobos ransomware variants observed as recently as February 2024, according to open source reporting. Phobos is structured as a ransomware-as-a-service (RaaS) model. Since May 2019, Phobos ransomware incidents impacting state, local, tribal, and territorial (SLTT) governments have been regularly reported to the MS-ISAC. These incidents targeted municipal and county governments, emergency services, education, public healthcare, and other critical infrastructure entities to suc