8Base

8Base is a ransomware and data-extortion cybercrime operation that emerged in March 2022 and became highly active in the summer of 2023. The group operates as a Ransomware-as-a-Service (RaaS) affiliate, utilizing ransomware strains including a variant known as Phobos. Despite positioning themselves as honest and simple pentesters, 8Base has been responsible for significant attacks against small to medium-sized businesses across multiple sectors. The group employs double extortion tactics, combining traditional ransomware encryption with data exfiltration. In July 2023, 8Base alongside Cl0p and LockBit were responsible for 48% of all recorded cyberattacks. The group was significantly disrupted in February 2025 when international law enforcement arrested four key individuals and shut down their dark web infrastructure.