Experts warn of a spike in May and June of 8Base ransomware attacks

Researchers warn of a massive spike in May and June 2023 of the activity associated with the ransomware group named 8Base.

VMware Carbon Black researchers observed an intensification of the activity associated with a stealthy ransomware group named 8Base. The experts observed a massive spike in activity associated with this threat actor between May and June 2023.

The group has been active since March 2022, it focused on small and medium-size businesses in multiple industries, including finance, manufacturing, business services, and IT.

“The group utilizes encryption paired with ‘name-and-shame’ techniques to compel their victims to pay their ransoms,” reads the report published by VMware Carbon Black. “8Base has an opportunistic pattern of compromise with recent victims spanning across varied industries.”

Security experts attributed 67 attacks to the group in May 2023, most of the victims are in the U.S. and Brazil.

“New analysis from NCC Group’s Global Threat Intelligence team has revealed that ransomware attacks are soaring, with 436 victims in May. The new figures represent a 24% surge compared to April’s figure of 352 and a 56% increase compared to May 2022.” reported NCC.

“The spike in activity was in-part been driven by the emergence of 8base, a new ransomware player that employs a double extortion strategy, publicising the data of 67 victims in May.”

VMware researchers noticed similarities between 8Base and the ransomware group RansomHouse.

VMware researchers also noticed that Phobos ransomware uses the “.8base” file extension for encrypted documents, a circumstance that suggests a possible link to the 8Base group or the use of the same code-base for their ransomware.

“The speed and efficiency of 8Base’s current operations does not indicate the start of a new group but rather signifies the continuation of a well-established mature organization. Whether 8Base is an offshoot of Phobos or RansomHouse remains to be seen.” continues the report.

The 8BASE group claims to be composed of honest pentesters.

“We are honest and simple pentesters. We offer companies the most loyal conditions for the return of their data,“ states the group on its leak site. “This list contains only those companies that have neglected the privacy and importance of the data of their employees and customers,”.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, 8Base)