Home › Threat Actors › 8Base
← All Threat Actors
Cybercrime medium Russia

8Base

DOJ indictment against Roman Berezhnoy and Egor Nikolaevich Glebov; four Russian nationals arrested in Phuket, Thailand (Feb 2025). Never built its own encryptor — deployed a leaked, customized Phobos builder (v2.9.1). Ransom-note wording near-identical to RansomHouse's, per VMware — suggestive of template copying, not a confirmed organizational link. · Financial — double extortion via a leased Phobos build

Reports 1
Active Since March–April 2022
Last Reported 29 Aug 2026
Sectors Targeted professional-services, manufacturing, healthcare, transportation, education

Tactics, Techniques & Procedures (TTPs)

  • SmokeLoader for initial loading/obfuscation, followed by Phobos v2.9.1 (AES) deployment
  • SystemBC as a C2 proxy layer; terminates Office apps and security tools before encrypting
  • .8base file extension; ransom note lacks a Jabber contact (unlike other Phobos affiliates)
  • Tor leak site with published FAQ and negotiation rules; Telegram/Twitter contact

Known Targets

Small and midsize businesses, weighted toward professional services (~32%) and manufacturing (~24%)Most-hit countries: US and Brazil, then UK, China, India, AustraliaLuka Rijeka (Croatian port operator, reported Dec 2024, no material damage per the company)

Analyst Notes

DISRUPTED: February 10–11, 2025 Europol-coordinated 'Operation Phobos Aetor' (14+ countries) arrested four alleged operators and seized the group's Tor leak/negotiation sites and dozens of backend servers. DOJ indictment describes an operation running May 2019–October 2024, 1,000+ victims, $16M+ paid, including a children's hospital and schools. As of October 2026, a tracker shows zero new victims in 30+ days — likely defunct, though this rests on tracker inactivity rather than a dedicated confirmation. Volkswagen was a claimed, not VW-confirmed, victim.

Also Known As

EightBaseDOJ internal designation 'Affiliate 2803'

MITRE ATT&CK Techniques

T1547.001 Boot or Logon Autostart Execution: Registry Run Keys T1135 Network Share Discovery T1562.001 Impair Defenses: Disable or Modify Tools T1490 Inhibit System Recovery T1486 Data Encrypted for Impact

Intelligence Reports

Analysis professional-servicesmanufacturing

8Base Went Quiet a Year and a Half Ago. The Takedown Explains Why — and What It Didn't Fix

Europol's February 2025 raid on 8Base arrested four alleged operators and seized its leak site. Eighteen months later, the Phobos-based extortion crew shows no sign of returning — but the builder it rode in on is still out there.

29 Aug 2026 · 8 min read