Loading malware…
8Base is a Windows ransomware family and associated financially motivated extortion operation that uses a customized version of Phobos. Its activity increased substantially in mid-2023, and it primarily targets small and medium-sized organizations worldwide. Attacks follow a double-extortion model: operators steal data before encrypting systems and threaten to publish it on a Tor-based leak site. SmokeLoader has been used to deliver the ransomware.
The encryptor is written in C/C++ and encrypts files using AES-256-CBC, with a randomly generated initialization vector for each file. It encrypts the AES key with RSA and appends recovery-related cryptographic material to encrypted files. It enumerates drives and files, avoids selected operating-system content and already encrypted files, and leaves ransom notes. Persistence is established through startup locations and autorun registry entries. The malware deletes shadow copies and backup catalogs, disables Windows recovery features and the firewall, and uses runtime code decryption and dynamic import reconstruction to complicate analysis. Observed 8Base intrusions have also involved AnyDesk deployment, LSASS credential dumping, privilege escalation, and PowerShell execution.
8Base is closely connected to the Phobos ecosystem; Faust operators have also used its leak site to publish stolen data. International law enforcement disrupted 8Base/Phobos infrastructure in Thailand in February 2025. Japan’s National Police Agency subsequently made a free decryption tool and English-language guidance available for Phobos and 8Base victims.
3 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
S-RM has recently seen data obtained by the Faust team appear on the leak site of 8Base, a ransomware group whose activity began ramping up in mid-2023.
It appears this IP address is hosting the 8Base Ransomware group’s Data Leak Site.
The 8base ransomware group was unveiled in May 2023... 8base primarily targets small and medium-sized companies worldwide in double extortion campaigns.
12 distinct techniques documented for this family, organized by ATT&CK tactic.
First, it copies itself to three different folders on the system... Startup... Next, it creates new Registry keys to enable itself to auto-start: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mtx777 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mtx777
The attackers were also observed dumping credentials from the Local Security Authority Subsystem Service (LSASS) memory, creating new processes with an existing user token to bypass access controls...
The attackers were also observed dumping credentials from the Local Security Authority Subsystem Service (LSASS) memory, creating new processes with an existing user token to bypass access controls...
First, it copies itself to three different folders on the system... Startup... Next, it creates new Registry keys to enable itself to auto-start: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mtx777 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mtx777
The attackers were also observed... escalating privileges using the runas command...
The attackers were also observed dumping credentials from the Local Security Authority Subsystem Service (LSASS) memory, creating new processes with an existing user token to bypass access controls...
The attackers were also observed dumping credentials from the Local Security Authority Subsystem Service (LSASS) memory, creating new processes with an existing user token to bypass access controls...
It executes some commands to delete shadow copies, backup catalogs, change BootStatusPolicy and disable Recovery Mode. vssadmin delete shadows /all /quiet ... wbadmin delete catalog -quiet
It also executes the following commands to disable the firewall: netsh advfirewall set currentprofile state off netsh firewall set opmode mode=disable
The attackers were also observed dumping credentials from the Local Security Authority Subsystem Service (LSASS) memory...
8Base begins searching for available drives on the system with ‘GetLogicalDrives’... To search files on the drive, 8Base uses the ‘FindFirstFileW’ and ‘FindNextFileW’ functions.
To deliver 8Base ransomware to the victims' machines, threat actors used SmokeLoader, a botnet that is very popular for ransomware attacks.
the threat actors announced the publication of leaked data from the past year's operation, indicating that in addition to encrypting user files, the group has also exfiltrated data to its own servers.
Impact (TA0040) T1486 Data Encrypted for Impact Deploy ransomware and encrypt critical systems.
It executes some commands to delete shadow copies, backup catalogs, change BootStatusPolicy and disable Recovery Mode.
21 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
35 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.