8Base

8Base is not a separate piece of ransomware. According to the US Justice Department, it was a name used by an affiliate organization that attacked victims with Phobos. An affiliate is a criminal partner who rents or buys a ransomware tool from its developers and runs the attacks itself. On February 10, 2025, the department unsealed charges against two Russian nationals, Roman Berezhnoy and Egor Nikolaevich Glebov, who it says operated the group under the names “8Base” and “Affiliate 2803”, among others. An indictment is an allegation. The defendants are presumed innocent until proven guilty.

Scale

The department says the group victimised more than 1,000 public and private entities in the United States and around the world and received over 16 million US dollars in ransom payments. It dates the alleged activity from May 2019 to at least October 2024. Victims included a children’s hospital, health care providers and educational institutions. The department does not name them, and neither does this page.

How the group worked

The charges describe a double extortion pattern. Double extortion means the attackers steal data first, then lock the systems, so that the victim faces two threats: lost access and a public leak. The department says the group copied files from victim networks, encrypted the originals with Phobos and left a ransom note. It also contacted victims directly to start payment talks. It threatened to expose the stolen files to the public or to the victims’ clients, customers or constituents, and it ran a darknet website where it repeated those threats and published stolen data when a victim did not pay.

The money flow is also described. After an attack, affiliates paid fees to Phobos administrators for a decryption key. Each Phobos deployment had its own alphanumeric string to match it to its key, and each affiliate paid into a wallet unique to that affiliate.

The Phobos advisory

CISA, the FBI and the Multi-State Information Sharing and Analysis Center (MS-ISAC) published advisory AA24-060A, dated February 29, 2024, on Phobos. The Justice Department’s release points readers to it. It says Phobos is structured as ransomware as a service and that, since May 2019, incidents hitting state, local, tribal and territorial governments have been regularly reported. Targets included municipal and county governments, emergency services, education, public healthcare and other critical infrastructure. The advisory describes the tools seen with Phobos, including SmokeLoader, Cobalt Strike, Bloodhound, Mimikatz, WinSCP and Mega.io. It does not say which of these 8Base used.

How Phobos gets in and operates, per CISA

The CISA advisory says Phobos actors use several routes in. Phishing emails carry hidden payloads such as SmokeLoader. Actors scan for exposed Remote Desktop Protocol ports with IP scanning tools such as Angry IP Scanner and then use open source brute force tools. They have also used remote access tools to hold a connection inside the network. For persistence they use Windows Startup folders and Run registry keys. For discovery and credentials they use BloodHound, Sharphound, Mimikatz and NirSoft tools, and for exfiltration WinSCP and Mega.io, archiving files as .rar or .zip.

The advisory says each Phobos executable has unique build identifiers, affiliate identifiers and its own ransom note, and that actors delete volume shadow copies. It lists MITRE techniques including Active Scanning: Scanning IP Blocks (T1595.001), Brute Force (T1110), Data Encrypted for Impact (T1486) and Inhibit System Recovery (T1490). As above, the advisory does not say which of these 8Base used.

The charges

The Justice Department says the 11-count indictment against Roman Berezhnoy and Egor Nikolaevich Glebov includes wire fraud conspiracy, wire fraud, computer fraud conspiracy, three counts of intentional damage to protected computers, three counts of extortion related to computer damage, transmitting threats to impair data confidentiality and unauthorized access. The release lists maximum sentences of 20 years for each wire fraud-related count, 10 years for each computer damage count and 5 years for the other counts. These are legal maximums, not predictions. The charges remain allegations.

Law-enforcement action

The department says the two defendants were arrested in the week of its release, as part of a coordinated international disruption that included more arrests and technical disruption of the group’s infrastructure. It adds that Europol and German authorities announced an international operation, involving the FBI and other partners, to disrupt over 100 servers tied to the network. It also notes the earlier arrest and extradition of Evgenii Ptitsyn, a Russian national charged over his alleged administration of Phobos. The department thanks partners in the United Kingdom, Germany, Japan, Spain, Belgium, Poland, the Czech Republic, France, Thailand, Finland, Switzerland and Romania. The Europol announcement itself could not be opened for this page, so the operation’s code name and server count from Europol are not repeated here.

Double extortion, per the US Justice Department: the group allegedly stole files, encrypted the originals with Phobos, left a ransom note and contacted victims to negotiate. It threatened to expose stolen files to the public or to victims' clients, customers or constituents, and ran a darknet website where it published stolen data if a victim did not pay.