Phobos Ransomware Aggressively Targeting U.S. Critical Infrastructure

U.S. agencies (CISA, FBI, MS-ISAC) warned of ongoing Phobos ransomware campaigns operating as RaaS that target government, critical infrastructure, and public-sector organizations; the report outlines initial access via phishing and exposed RDP, post-compromise tools and techniques (process injection, token theft, SeDebugPrivilege), use of BloodHound/SharpHound for AD discovery, exfiltration via WinSCP/Mega, and destruction of shadow copies—additionally noting opportunistic exploitation of CVE-2023-38035 by other ransomware actors and rising ransom demand trends.