Executive Summary
8Base first surfaced around March–April 2022 as a double-extortion operation with a conspicuous habit: a leak site written in the same voice, and with ransom-note language nearly identical to, the older RansomHouse group. It never built its own encryptor. Every confirmed intrusion rode a customized, leaked build of the Phobos ransomware toolkit (version 2.9.1), appending the .8base extension to encrypted files. On February 10–11, 2025, a 14-country Europol-coordinated operation — dubbed “Operation Phobos Aetor” — arrested four Russian nationals in Phuket, Thailand, and seized the group’s Tor leak and negotiation sites along with dozens of backend servers. The US Department of Justice unsealed an 11-count indictment against two alleged ringleaders, Roman Berezhnoy and Egor Nikolaevich Glebov, describing an operation that ran from May 2019 through October 2024 and touched more than 1,000 victims, including a children’s hospital and multiple schools. As of this writing, third-party trackers show zero new 8Base victims in the trailing 30 days — the group appears defunct, though nothing in the public record formally confirms that rather than a prolonged dormancy.
What 8Base Actually Was
Despite the branding, 8Base was not a ransomware developer in the traditional RaaS sense. HC3’s threat profile classifies it as a data-extortion operation that leased access to the Phobos builder — a kit that had already leaked and circulated among multiple unrelated affiliate crews — rather than one that wrote and maintained its own malware. That distinction matters for anyone trying to map “8Base” to a single coherent engineering team: there wasn’t one. What was coherent was the business layer — the leak site, the negotiation process, and a ransom note that read as close to a word-for-word match of RansomHouse’s as VMware’s analysts had seen. VMware stopped short of calling 8Base a RansomHouse spinoff on that basis alone, noting that copied note templates and leak-site wording don’t prove an organizational link — they could just as easily reflect one group lifting the playbook of another. Treat the RansomHouse connection as circumstantial, not established.
The group’s own public messaging leaned into “simple pen testers” framing on its leak site — a familiar bit of self-serving minimization that dozens of extortion crews use, and not something to take as a reliable account of its own conduct given what the DOJ indictment alleges about scale and victim types.
Toolchain and Intrusion Pattern
The infection chain Trend Micro and VMware both documented runs: SmokeLoader for initial loading and obfuscation, followed by deployment of the Phobos v2.9.1 binary, with SystemBC used as a C2 proxy layer. Before encrypting, the payload terminates Office applications and common security tooling. The specific initial-access vector was never firmly pinned down in public reporting — researchers assessed it as likely opportunistic phishing rather than a signature exploit chain, which is a meaningfully less precise picture than groups with a documented CVE of choice.
The ransom note itself had an identifying quirk: no Jabber contact address, which set it apart from several other Phobos-builder affiliates that did include one. Victims were directed to a Tor leak site with a published FAQ and “negotiation rules,” along with Telegram and Twitter/X contact handles for the group’s public-facing presence.
Who Got Hit
HC3 and Trend Micro both describe the victim profile as weighted toward small and midsize businesses, with the United States and Brazil as the most frequently hit countries, followed by the UK, China, India, and Australia — and no observed targeting inside CIS countries, the usual tell for Russia-nexus crews avoiding domestic law enforcement attention. Trend Micro tracked 224 distinct attack attempts in 2023 alone, with manufacturing the hardest-hit sector that year. A later aggregator snapshot (Proven Data, pulled in 2026) put professional services at roughly 32% of cumulative claimed victims and manufacturing at 24%, with healthcare around 7%, spread across 45 countries.
Two named incidents are worth flagging carefully because the public record treats them differently. Luka Rijeka, a Croatian port operator, was reported breached in December 2024; the company stated there was no material operational damage. Volkswagen Group was separately claimed as a victim by 8Base on its leak site, alleging data theft — but Volkswagen confirmed only that it had experienced a security “incident,” without confirming 8Base’s specific claim or the scope the group alleged. Both of those distinctions — reported-with-limited-impact versus claimed-but-not-corroborated — matter if you’re trying to assess real exposure rather than leak-site marketing.
The Takedown
The DOJ’s unsealed indictment against Berezhnoy and Glebov lays out an operation running from May 2019 to October 2024, well predating 8Base’s public 2022 debut — consistent with the idea that this was an established extortion operation that adopted the 8Base brand partway through its run rather than starting fresh with it. Prosecutors allege more than 1,000 victims and over $16 million paid in ransoms, with named victim categories including a children’s hospital and several schools. Europol’s operation seized the group’s Tor-based leak and negotiation infrastructure — both sites now display a law enforcement seizure banner rather than victim listings — along with a reported 27 to 100+ backend servers, depending on the source counted.
A related figure, Evgenii Ptitsyn, described as a Phobos ransomware-as-a-service administrator, was separately extradited to the United States in November 2024 — adjacent to, but a distinct legal action from, the February 2025 8Base-specific arrests.
Status Check, Late 2026
A live tracker (Proven Data, checked October 19, 2026) shows 455 total claimed 8Base victims across its history, with zero recorded in the trailing 30 days. That is consistent with a group that was effectively ended by the February 2025 operation rather than one that scaled back and kept running. It is not, on its own, proof of permanent shutdown — automated victim trackers reflect leak-site activity, and a defunct leak site reads identically to a dormant one until something happens to distinguish them. No credible reporting of an 8Base rebrand, relaunch, or renewed activity under any name was found through October 2026.
What This Means
The 8Base story is a reasonably clean illustration of a pattern that’s become more common in ransomware enforcement: the takedown targets the business operation — leak site, negotiation infrastructure, named operators — rather than the underlying tooling. Phobos as a builder predates 8Base, leaked before 8Base existed, and continued to circulate among other affiliates independent of this case. Disrupting 8Base specifically does not retire Phobos-based ransomware as a threat category; it removes one operator that built a visible brand and victim count around it. Organizations that were tracking “8Base” as a named risk in their threat models should update that entry to reflect the group’s apparent end, while keeping Phobos-derived payloads — likely to resurface under other affiliate brands — on the list.