Overview
- Evgenii Ptitsyn, 43, admitted to a wire fraud conspiracy and is set for sentencing on July 15, facing up to 20 years in prison.
- Court filings describe him as an administrator since at least November 2020 who sold access to Phobos on criminal forums using the aliases “derxan” and “zimmermanx.”
- Affiliates paid roughly $300 per attack for a unique decryption key, with thousands of these fees flowing into cryptocurrency wallets Ptitsyn controlled, and he sometimes took a share of ransoms.
- He was arrested in South Korea in June 2024 and extradited to the United States in November 2024 as investigations targeted Phobos operators and affiliates.
- Prosecutors cite more than 1,000 global victims, including at least 890 in the U.S., and say Ptitsyn agreed to forfeit $1.77 million and pay at least $39.3 million in restitution.