International Takedown Disrupts Phobos and 8Base Ransomware Networks

Authorities in a coordinated international operation arrested alleged key affiliates tied to the Phobos ransomware-as-a-service operation and the 8Base extortion group, with enforcement actions reported across multiple jurisdictions including Thailand. The U.S. Department of Justice said Phobos affiliates were arrested as part of a broader disruption effort, while Europol described the suspects as central figures behind two of the most active ransomware threats targeting organizations worldwide.

The crackdown also included the seizure of 8Base infrastructure, including its leak site, dealing a visible blow to the group’s public extortion operations. Reporting from Europol and security outlets linked 8Base closely to Phobos, indicating that investigators targeted both the malware supply chain and the actors using it to conduct intrusions, encrypt systems, and pressure victims into paying ransoms.