8Base Ransomware Attacks Pick Up in Volume in Mid-2023
An under-the-radar ransomware threat known as 8Base has recently experienced a significant increase in activity during May and June 2023, according to researchers from VMware Carbon Black. This group employs encryption techniques combined with "name-and-shame" tactics to coerce their victims into paying ransoms. The 8Base ransomware has demonstrated an opportunistic pattern of compromising targets from various industries.
Data collected by Malwarebytes and NCC Group reveals that 8Base has been linked to 67 attacks as of May 2023, with approximately half of the victims belonging to the business services, manufacturing, and construction sectors. The majority of the targeted organizations are based in the United States and Brazil.
The origins of 8Base and the identities of its operators remain mysterious, with little information available about them. However, the researchers have found striking similarities between 8Base and another data extortion group called RansomHouse. The language used in the ransom notes and the welcome pages of both groups' data leak portals are virtually identical, suggesting a possible connection or influence between the two.
Similarities Between 8Base and Phobos
Although RansomHouse openly advertises its partnerships, 8Base does not. Additionally, there are differences in their leak pages. However, VMware discovered a Phobos ransomware sample that uses the same ".8base" file extension for encrypted files, raising the possibility that 8Base might be a successor to Phobos or that the attackers are leveraging existing ransomware strains instead of developing their own custom locker.
The researchers emphasize that the speed and efficiency of 8Base's operations indicate the continuation of an established and mature organization rather than the emergence of a new group. The relationship between 8Base, Phobos, and RansomHouse is still unclear and requires further investigation.
Apart from 8Base, new ransomware players such as CryptNet, Xollam, and Mallox have entered the market, while well-known families like BlackCat, LockBit, and Trigona continue to enhance their features and attack chains to target Linux and macOS systems in addition to Windows.
Cybersecurity analysts have observed instances where threat actors have employed BATLOADER to distribute Mallox, indicating their active efforts to refine tactics for increased stealthiness and the maintenance of their malicious activities.
