Loading threat actor…
8Base is a financially motivated ransomware and extortion operation active since at least March 2022, with a substantial increase in activity in mid-2023. Also tracked as 8base_ransomware_actors, it opportunistically compromises organizations across multiple industries, including healthcare, food and agriculture, and manufacturing. Its victims include Japanese organizations and operations in Vietnam. 8Base uses a customized version of Phobos ransomware and conducts double extortion, stealing data before encrypting systems and threatening publication through a Tor-accessible victim-shaming site. Its leak site supports victim communication and ransom negotiations. Data stolen by Faust operators, a Phobos affiliate team, has also appeared on the 8Base site; Faust is not established as an 8Base subgroup. Observed attack activity includes ransomware delivery through SmokeLoader, abuse of AnyDesk for remote access, LSASS credential dumping, access-token manipulation, privilege escalation, and PowerShell execution. Its ransomware establishes persistence through startup mechanisms and Registry autorun entries, disables the Windows firewall, deletes shadow copies and backup catalogs, and inhibits system recovery. File encryption uses AES-256-CBC with RSA protection of the encryption key.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
23 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
3 malware families attributed to this actor across reporting.
25 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned only as one of several ransomware families tied to Woodgnat/KongTuke.
Mentioned only as one of the groups that claimed responsibility for a separate 2024 ransomware attack against another Nidec division.
Named as one of the ransomware groups publicly linked to Woodgnat as a downstream partner or affiliate receiving sold access.
Previously claimed a separate ransomware-related extortion incident involving Nidec's Vietnam-based Nidec Precision division in 2024.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.