8base

8base, a significant threat actor in the cybersecurity landscape, has been active between April 2022 and May 2023. This group, while not new, has recently increased its visibility with the activation of a public leak site used to pressure victims into paying ransoms. In the last month alone, 8base operators were responsible for 15% of all recorded ransomware attacks, largely targeting the industrial sector using a double extortion technique that involves both stealing and encrypting victims' data. The group operates similarly to previous Phobos campaigns, utilizing the same format for the appended portion of their ransomware, which includes an ID section, an email address, and a file extension. The group, tracked as 8base, claimed the second-most active position behind LockBit 3.0, amassing a total of 67 victims. According to a report by NCC Group, the data used in the Threat Pulse is based on the date of victim discovery, not the date of initial publication or data breach. Despite this, May's numbers this year are still 56% higher than those in May 2022 and a slight 5% higher than April 2023, even when excluding the 8base attacks. Looking forward, the cybersecurity landscape in 2024 is expected to become more challenging with both old-guard groups and newcomers like Akira, Play, and 8base projected to play dominant roles. Specifically, 8base has already attacked 281 organizations, distinguishing itself as a data-extortion cybercrime group rather than solely a ransomware operation. Their modus operandi involves swiftly encrypting local drives and shares using AES256 in CBC mode. Interestingly, despite the severity of the 8base ransomware attack, targeted organizations' websites remain fully functional, showing no visible signs of abnormalities.