Government release # Phobos Ransomware Affiliates Arrested in Coordinated International Disruption United States Department of Justice, February 10, 2025. US charges against Roman Berezhnoy and Egor Nikolaevich Glebov, the 8Base / 'Affiliate 2803' affiliate organization, 1,000+ victims and over $16 million in ransom payments, and the arrests accompanying the international disruption. **Source type:** Government release **Published:** February 10, 2025 **Research grade:** P1 **Used in entries:** 7 ## Bibliographic record **Publisher:** United States Department of Justice **Published:** February 10, 2025 **Source type:** Government release **Research grade:** Source grade P1 **Language:** English **Official record:** Official publication **Address:** [https://www.justice.gov/opa/pr/phobos-ransomware-affiliates-arrested-coordinated-international-disruption](https://www.justice.gov/opa/pr/phobos-ransomware-affiliates-arrested-coordinated-international-disruption) **What it supports:** US charges against Roman Berezhnoy and Egor Nikolaevich Glebov, the 8Base / 'Affiliate 2803' affiliate organization, 1,000+ victims and over $16 million in ransom payments, and the arrests accompanying the international disruption **Dataset id:** src\_doj\_phobos\_2025 ## Research notes - Live page fetched 2026-08-23; the article header reads 'Monday, February 10, 2025' and the page's machine-readable date is 2025-02-10T12:00:00Z. - DOJ press release number 25-153; components include the Criminal Division, CCIPS, Office of International Affairs, FBI, NSD and USAO-Maryland. - A companion USAO-Maryland version of the same release exists at https://www.justice.gov/usao-md/pr/phobos-ransomware-affiliates-arrested-coordinated-international-disruption and is dated 2025-02-11; do not conflate the two dates. How this source is used Cited 7 times across 4 record types. The role on each citation records what the source was relied on for. A primary source establishes the fact, a supporting source corroborates it, technical evidence describes the infrastructure, and a later outcome records what happened afterwards. Sources were reviewed to a research cutoff of August 23, 2026. Addresses recorded after that date are not reflected here. ## Cited by ### Takedown records 1 citation Cited on the takedown record itself. - [Phobos/8Base ransomware disruption](https://takedownindex.org/takedowns/phobos-8base-ransomware-disruption) Ransomware, February 2025 Supporting source ### Organization roles 1 citation Cited for an organization's recorded role in a takedown. - [Federal Bureau of Investigation](https://takedownindex.org/takedowns/phobos-8base-ransomware-disruption) Investigating, Phobos/8Base ransomware disruption Primary source ### Legal actions against people 4 citations Cited for a recorded legal action against a named person. - [Roman Berezhnoy](https://takedownindex.org/people/roman-berezhnoy) Indicted, Phobos/8Base ransomware disruption Primary source - [Egor Nikolaevich Glebov](https://takedownindex.org/people/egor-nikolaevich-glebov) Indicted, Phobos/8Base ransomware disruption Primary source - [Roman Berezhnoy](https://takedownindex.org/people/roman-berezhnoy) Arrested, Phobos/8Base ransomware disruption Primary source - [Egor Nikolaevich Glebov](https://takedownindex.org/people/egor-nikolaevich-glebov) Arrested, Phobos/8Base ransomware disruption Primary source ### Infrastructure 1 citation Cited for infrastructure recorded as acted on. - [more than 100 servers](https://takedownindex.org/takedowns/phobos-8base-ransomware-disruption) Servers disabled, Phobos/8Base ransomware disruption Primary source [All sources](https://takedownindex.org/sources)