Phobos Ransomware Recovery: Free Decryptor, What It Covers, and What to Do When It Fails

Phobos is a ransomware-as-a-service family active since 2018 and one of the most common in small and mid-size businesses, schools, hospitals and local offices. The US CISA, FBI and MS-ISAC described it in their joint advisory AA24-060A (February 2024): affiliates usually get in through exposed or weakly protected Remote Desktop (RDP), and use common tools such as SmokeLoader and Cobalt Strike.

Encrypted files are renamed in a recognisable pattern: the original name, an .id[XXXXXXXX-XXXX] tag, the attacker's e-mail address in brackets, and an extension. Many extensions are in use, including .phobos, .eking, .eight, .elbie, .faust, .devos, .LIZARD and .8base (8Base was a group built on Phobos). The ransom note is usually info.hta and info.txt.

In July 2025 Japan's National Police Agency released a free decryptor for Phobos and 8Base, developed with the FBI and tested with Europol. It is available from the police website and from No More Ransom. Files ending in .phobos, .8base, .elbie, .faust and .LIZARD are listed, and other Phobos variants may work too.

Always run it on copies of the encrypted files, never on the only copy, and download it only from the official sites: fake "Phobos decryptors" are a common trap. The tool is not a universal master key, so some incidents are not covered.

We have recovered Phobos cases ourselves, including ones where the decryptor did not help. If the variant is not covered or the decryption fails, the data is not automatically lost. Very large files such as SQL Server databases, virtual disks and backups are often not encrypted end to end, and the parts that were not encrypted can be read directly. We recover the tables of an encrypted MDF or BAK from the database pages that survived, and virtual machines and files from partly encrypted VMDK, VHDX and backup files.

Keep the encrypted files exactly as they are, do not run repair tools on them, and copy them before trying anything. Then send us a sample for a free assessment. No data, no charge.

Phobos is opportunistic: it goes where RDP is open to the internet with weak passwords. Close RDP to the internet or put it behind a VPN with multi-factor authentication, use long unique passwords, lock out repeated failed logins, and keep at least one backup offline where a compromised server cannot reach it.