# Roman Berezhnoy

No alias recorded

Indicted, Arrested

Public record reviewed to August 23, 2026

Index entry last updated August 23, 2026

_Alleged_ operator of the 8Base / Affiliate 2803 Phobos ransomware affiliate group.

Every charge in this entry is an allegation. No conviction is recorded.

Everything on this page comes from cited public sources.

This entry records 2 actions across 1 takedown, each traced to a cited source. At least one linked takedown was added in the extended pass and was not independently source verified. Where the record is silent, this page says so rather than filling the gap.

Legal summary

**Associated takedowns:** [Phobos/8Base ransomware disruption](https://takedownindex.org/takedowns/phobos-8base-ransomware-disruption)

**Recorded role:** Operator of the 8Base / Affiliate 2803 Phobos ransomware affiliate group

**Group segment:** Affiliate

**Charging authority:** United States Department of Justice

**Charging jurisdiction:** Not recorded

**Case number:** 8:23-cr-00459

**Latest recorded action:** Arrested, February 2025

**Nationality:** Russia

**Country of residence:** Not established

- [Associated takedowns](https://takedownindex.org/people/roman-berezhnoy)
- [Legal history](https://takedownindex.org/people/roman-berezhnoy/legal-history)
- [Charges](https://takedownindex.org/people/roman-berezhnoy/charges)
- [Sources](https://takedownindex.org/people/roman-berezhnoy/sources)

## Associated takedowns

Law enforcement actions against infrastructure and services linked to this person, and the action recorded against the person in each one.

Outcomes and dates follow the public reporting cited on the sources tab and are subject to revision.

2 recorded actions across 1 takedown

| Date | Takedown | Target | Connection | Outcome |
| --- | --- | --- | --- | --- |
| December 14, 2023, [Source [1]](https://takedownindex.org/people/roman-berezhnoy/sources#source-1) | [Phobos/8Base ransomware disruption](https://takedownindex.org/takedowns/phobos-8base-ransomware-disruption), Ransomware | Phobos and 8Base, 8Base data leak and negotiation site | Operator of the 8Base / Affiliate 2803 Phobos ransomware affiliate group | Indicted. 11-count indictment filed under seal 2023-12-14 and unsealed 2025-02-10. |
| February 10, 2025, [Source [1]](https://takedownindex.org/people/roman-berezhnoy/sources#source-1) | [Phobos/8Base ransomware disruption](https://takedownindex.org/takedowns/phobos-8base-ransomware-disruption), Ransomware | Phobos and 8Base, 8Base data leak and negotiation site | Operator of the 8Base group | Arrested. One of four Russian nationals arrested in Phuket in Operation Phobos Aetor. |