Evgenii Ptitsyn, the Russian national described by U.S. authorities as a Phobos ransomware administrator, was extradited from South Korea to the United States in November 2024. The U.S. Department of Justice (DOJ) later announced that he pleaded guilty to wire fraud conspiracy on March 4, 2026. His sentencing outcome is not established by the official information cited here.
What happened to Evgenii Ptitsyn?
Ptitsyn appeared in the U.S. District Court for the District of Maryland on November 4, 2024, after being extradited from South Korea. The DOJ announced the extradition and initial court appearance on November 18, 2024. At that stage, the department said more than 1,000 public and private entities had been affected and that ransom payments exceeded $16 million. DOJ’s 2024 announcement attributed those figures to its case.
On March 4, 2026, DOJ announced that Ptitsyn had pleaded guilty to wire fraud conspiracy. The department’s later release again reported more than 1,000 public and private entities affected, but put ransom payments at more than $39 million. These are dated DOJ figures from separate stages of the case, not a single unchanged total. DOJ’s guilty-plea announcement gives the later figure.
What the guilty plea covers—and what DOJ alleges about Phobos
The plea is to wire fraud conspiracy. DOJ’s account of the broader Phobos operation describes administrators who offered ransomware access to criminal affiliates. According to the department, affiliates accessed victims’ networks, often using stolen or unauthorized credentials; copied files and programs; encrypted data; demanded payment for decryption keys; and threatened to publish stolen files if victims refused to pay. DOJ says administrators coordinated distribution through a darknet website and promoted the operation on criminal forums and messaging platforms.
Recommended Free Tools
#1 Best Overall
DOJ further says that from December 2021 to April 2024, fees for affiliate decryption keys moved from affiliate-specific cryptocurrency wallets to a wallet Ptitsyn controlled, and that he received a portion of victim payments. This is the department’s description of the wider scheme; it should not be mistaken for a separate list of counts to which Ptitsyn pleaded guilty.
Sentencing status and related enforcement action
DOJ’s March 2026 release said sentencing was scheduled for July 15, 2026, at 2:30 p.m. The official information cited here does not establish whether that hearing took place or what sentence followed. DOJ described a maximum penalty of 20 years for the wire fraud conspiracy count; that is a statutory maximum, not an indication of the sentence imposed. No current custody status is established here.
In a separate February 2025 announcement, DOJ reported charges against Roman Berezhnoy and Egor Glebov and a coordinated operation that disrupted more than 100 servers associated with the Phobos criminal network. Those defendants’ allegations and proceedings are distinct from Ptitsyn’s guilty plea. DOJ’s 2025 announcement describes that action.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to read the reported impact figures
The payment estimates rose between DOJ’s announcements: the November 2024 extradition release reported more than $16 million, while the March 2026 guilty-plea release reported more than $39 million. Both releases also reported more than 1,000 affected public and private entities. They are official case-related figures attributed to DOJ; they are not independent statistical estimates.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Best Value
Rank #3
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
