Understanding the Phobos affiliate structure and activity

• Cisco Talos recently identified the most prolific Phobos variants, common affiliate tactics, techniques and procedures (TTPs), and characteristics of the Phobos affiliate structure, based on observed Phobos activity and analysis of over 1,000 Phobos samples from VirusTotal dating back to 2019.


• We assess with moderate confidence Eking, Eight, Elbie, Devos and Faust are the most common Phobos variants, as they appeared most frequently across the samples we analyzed. 


• The affiliates use similar TTPs to deploy Phobos and commonly target high-value …

affiliate analysis back cisco cisco talos dating procedures structure tactics talos techniques techniques and procedures ttps understanding virustotal