In October 2023, the 8Base ransomware gang emerged as a significant threat by targeting a U.S.-based healthcare facility. Active since March 2022, 8Base uses a double extortion approach, where it not only encrypts a victim’s files but also threatens to leak sensitive data. Despite their claims of being “penetration testers,” their true motive is financial gain, as they indiscriminately target small to medium-sized businesses (SMBs) across multiple sectors, especially in the Healthcare and Public Health (HPH) sector.
This article explores the 8Base ransomware’s operations, how it gains access to systems, its technical structure, industries and regions targeted, and the defensive measures that can be employed to prevent future attacks.
Table of Contents
- What Is 8Base Ransomware?
- How 8Base Ransomware Operates?
- Infection Chain and Techniques of 8 Base Ransomware
- Decrypting 8Base Ransomware with Phobos Decryptor
- Steps to Decrypt Your Files Using Phobos Decryptor
- Top of the line Targeted by 8Base Ransomware
- Impact on Healthcare and Public Health Sector
- Technical Breakdown: How 8Base Ransomware Works
- Defense and Mitigation Strategies for 8Base Ransomware
What Is 8Base Ransomware?
The 8Base ransomware group brands itself as “simple penetration testers,” aiming to justify its malicious activities. Its primary goal is double extortion: encrypting a company’s data and threatening to leak it if the ransom is not paid. This tactic, commonly known as “name-and-shame,” involves publicly revealing the victim’s sensitive data, potentially damaging their reputation and finances.
While 8Base claims to only target companies that neglect data privacy, its victims suggest otherwise. Many of the group’s targets are small businesses that may lack robust cybersecurity measures, making them prime candidates for exploitation.
Related Article: Faust Ransomware Virus Decryption
How 8Base Ransomware Operates?
- Initial Detection and Evolution
First detected in March 2022, 8Base ransomware saw a major increase in activity starting in mid-2023, aligning itself with other prominent ransomware gangs like Cl0p and LockBit. By July 2023, these three groups were responsible for nearly 50% of all recorded ransomware attacks.
One of the group’s most notable attacks occurred in October 2023, targeting the healthcare sector. In response, the Health Sector Cybersecurity Coordination Center (HC3) issued a warning about 8Base’s capabilities.
- Double Extortion Tactics
8Base’s double extortion tactic is especially damaging. Victims face not only the threat of their files being encrypted but also the potential exposure of sensitive information, including customer and employee data. Even if companies have backups to recover their files, the fear of sensitive data being leaked adds additional pressure to meet ransom demands.
- Connections to RansomHouse and Phobos
Cybersecurity experts have observed significant similarities between 8Base and other ransomware groups, particularly RansomHouse and Phobos. Both groups share common tactics, and analysis of ransom notes shows a 99% similarity between 8Base and RansomHouse. In fact, 8Base uses a customized version of Phobos ransomware (version 2.9.1), with SmokeLoader as the initial loader.
Infection Chain and Techniques of 8 Base Ransomware
Initial Access:
The 8Base ransomware typically gains access through phishing emails or exploit kits. Phishing campaigns often involve malicious attachments or links that deliver the ransomware payload. In some cases, the group has been observed using domains associated with SystemBC, a remote access tool (RAT).
Credential Access:
Once inside the system, 8Base operators use tools like MIMIKATZ, LaZagne, and WebBrowserPassView to retrieve stored credentials, which can then be used for lateral movement within the network.
Defense Evasion:
8Base is adept at evading detection. It disables Windows Defender using a batch file called defoff.bat (detected as KILLAV) and employs SmokeLoader to obfuscate its activities. It also uses techniques to delete Volume Shadow Copies and bypass firewalls.
Additionally, the ransomware is designed to evade Cuckoo Sandbox and clears Windows event logs to hide traces of its activity.
Ransomware Note
8base Ransomware typically drops a ransom notes on the infected system, info.txt. These notes inform the victim of the encryption and provide instructions for paying the ransom, usually in Bitcoin. The notes also include warnings against using third-party decryption tools or attempting to recover files without paying the ransom.
Lateral Movement and Privilege Escalation:
8Base operators use PsExec for lateral movement, allowing them to deploy the ransomware across multiple systems in the network. For privilege escalation, they modify certain registry entries and bypass User Access Control (UAC), allowing the ransomware to execute with administrative privileges.
Exfiltration and Impact:
After accessing and encrypting files using the AES-256 encryption algorithm, the attackers exfiltrate stolen data using tools like RClone. This data is then held hostage under threat of public exposure if the ransom is not paid.
Decrypting 8Base Ransomware with Phobos Decryptor
Now that we’ve covered the technical aspects, let’s discuss how to decrypt files compromised by 8Base ransomware. Fortunately, there’s no need to comply with the attackers’ demands. The Phobos Decryptor is a powerful tool specifically designed to tackle threats like 8Base ransomware, which uses the Phobos ransomware variant.
How Does Phobos Decryptor Work?
The Phobos Decryptor utilizes advanced decryption techniques and online servers to bypass the AES-256 and RSA-1024 encryption used by 8Base ransomware. Here’s how it functions:
- Server-Based Decryption: The decryptor requires an active internet connection to access specialized servers that calculate decryption keys based on vulnerabilities in the 8Base ransomware’s encryption process. This server-based method ensures the decryption of even the most complex encryption.
- User-Friendly Interface: The tool features a simple, intuitive interface, making it accessible for users without advanced technical knowledge. The decryption process can be initiated in a few easy steps.
- Safe and Effective: Unlike other third-party tools that may risk corrupting your data, the Phobos Decryptor is specifically tailored for Phobos variants like 8Base, ensuring safety and effectiveness.
- Availability: The Phobos Decryptor is a paid tool, and you can purchase it by contacting our team via email or WhatsApp.
Steps to Decrypt Your Files Using Phobos Decryptor
If your system has been infected by 8Base ransomware, follow these steps to decrypt your files:
- Purchase the Decryptor by contacting us.
- Download the Decryptor and run it as an administrator.
- Ensure your infected device is connected to the internet.
- Enter your ID found in the ransom note or encrypted files.
- Click on Decrypt Files.
- If you encounter any issues, our team will assist you remotely via Anydesk or a remote desktop connection.
Alternative Recovery Methods
While the Phobos Decryptor is a robust solution, there are other methods you can explore if you’re unable to use the decryptor:
- Free Data Recovery Tools: Programs like PhotoRec or TestDisk may recover unencrypted versions of files by scanning your hard drive. However, these tools are often less effective against sophisticated ransomware like 8Base.
- System Restore: If you had System Restore enabled before the attack, reverting your system to an earlier state may remove the ransomware, although it won’t recover encrypted files.
- Data Recovery Services: In severe cases, professional data recovery services may help retrieve your data, but this can be expensive and success is not guaranteed.
Top of the line Targeted by 8Base Ransomware
Top Affected Industries:
Based on Trend Micro threat intelligence data, 8Base ransomware has primarily targeted the manufacturing and technology sectors, followed by healthcare, finance, oil, and gas industries. While larger enterprises may have stronger defenses, SMBs are more frequently victimized due to weaker cybersecurity measures.
Geographic Targets:
North America is the primary target, with the United States leading in the number of attack attempts. Brazil, the United Kingdom, and the Netherlands have also been significantly affected. Interestingly, the gang has also targeted smaller nations like Costa Rica, Croatia, and the Bahamas.
Impact on Healthcare and Public Health Sector
The healthcare sector has been a frequent target of 8Base ransomware due to the high value of protected health information (PHI). Ransomware attacks on healthcare organizations can lead to significant disruptions in patient care, along with the potential exposure of sensitive medical data.
Healthcare organizations must remain particularly vigilant against threats like 8Base, as the consequences of a successful attack can be severe, both operationally and reputationally.
Technical Breakdown: How 8Base Ransomware Works
8Base ransomware uses the AES-256 encryption algorithm to encrypt files. It appends the “.8base” extension to each encrypted file, marking the infection. Once files are encrypted, a ransom note is dropped in various locations on the infected machine, often as a text or HTML application (HTA) file.
To evade defenses, 8Base disables key system protections, including Windows Defender and Volume Shadow Copies, ensuring that recovery options are limited for the victim.
Additional information
- The 8Base ransomware terminates the following processes to avoid conflict in its encryption routine:
- msftesql.exe
- sqlagent.exe
- sqlbrowser.exe
- sqlservr.exe
- sqlwriter.exe
- oracle.exe
- ocssd.exe
- dbsnmp.exe
- synctime.exe
- agntsvc.exe
- mydesktopqos.exe
- isqlplussvc.exe
- xfssvccon.exe
- mydesktopservice.exe
- ocautoupds.exe
- agntsvc.exe
- agntsvc.exe
- agntsvc.exe
- encsvc.exe
- firefoxconfig.exe
- tbirdconfig.exe
- ocomm.exe
- mysqld.exe
- mysqld-nt.exe
- mysqld-opt.exe
- dbeng50.exe
- sqbcoreservice.exe
- excel.exe
- infopath.exe
- msaccess.exe
- mspub.exe
- onenote.exe
- outlook.exe
- powerpnt.exe
- steam.exe
- thebat.exe
- thebat64.exe
- thunderbird.exe
- visio.exe
- winword.exe
- wordpad.exe
- 8Base ransomware avoids encrypting files with the following extensions:
- 8base
- actin
- dike
- acton
- actor
- acuff
- file
- acuna
- fullz
- mmxxii
- 6y8dghklp
- shtorm
- nurri
- ghost
- ff6om6
- mnx
- backjohn
- own
- fs23
- 2qz3
- top
- blackrock
- chcrbo
- g-stars
- faust
- unknown
- steel
- worry
- win
- duck
- fopra
- unique
- acute
- adage
- make
- adair
- mlf
- magic
- adame
- banhu
- banjo
- banks
- banta
- barak
- caleb
- cales
- caley
- calix
- calle
- calum
- calvo
- deuce
- dever
- devil
- devoe
- devon
- devos
- dewar
- eight
- eject
- eking
- elbie
- elbow
- elder
- phobos
- help
- blend
- bqux
- com
- mamba
- karlos
- ddos
- phoenix
- plut
- karma
- bbc
- capital
- wallet
- lks
- tech
- s1g2n3a4l
- murk
- makop
- ebaka
- jook
- logan
- fiasko
- gucci
- decrypt
- ooh
- non
- grt
- lizard
- flscrypt
- sdk
- 2023
- vhdv
- fdb
- sql
- 4dd
- 4dl
- abs
- abx
- accdb
- accdc
- accde
- adb
- adf
- ckp
- db
- db-journal
- db-shm
- db-wal
- db2
- db3
- dbc
- dbf
- dbs
- dbt
- dbv
- dcb
- dp1
- eco
- edb
- epim
- fcd
- gdb
- mdb
- mdf
- ldf
- myd
- ndf
- nwdb
- nyf
- sqlitedb
- sqlite3
- sqlite
- 8Base ransomware avoids encrypting files with the following strings: :
- info.hta
- info.txt
- boot.ini
- bootfont.bin
- ntldr
- ntdetect.com
- io.sys
- suppo
- bin.exe
MITRE ATT&CK Techniques Used by 8Base
| Tactic | Technique | Description |
|---|---|---|
| Initial Access | Phishing: Spearphishing Attachment (T1566.001) | Uses phishing emails with malicious attachments to gain initial access. |
| Credential Access | OS Credential Dumping (T1003) | Uses tools like MIMIKATZ and LaZagne to retrieve stored credentials. |
| Defense Evasion | Disable or Modify Tools (T1562.001) | Disables Windows Defender and clears event logs to avoid detection. |
| Lateral Movement | Remote Services: PsExec (T1021.002) | Uses PsExec to propagate the ransomware across the network. |
| Impact | Data Encrypted for Impact (T1486) | Encrypts files using AES-256 encryption. |
Defense and Mitigation Strategies for 8Base Ransomware
Best Practices for Protection:
To mitigate the risks posed by 8Base ransomware, organizations should implement the following best practices:
- Phishing Protection: Train employees to recognize phishing emails and avoid clicking on suspicious links or attachments.
- Strong Password Policies: Enforce the use of strong, unique passwords and implement multi-factor authentication (MFA) to secure access.
- Regular Patching: Ensure systems and software are regularly updated and patched to fix known vulnerabilities.
- Backup and Disaster Recovery: Maintain offline backups of critical data and regularly test recovery processes.
- Network Monitoring: Continuously monitor for unusual network traffic or connections to known malicious IP addresses and domains.
- Endpoint Protection: Deploy advanced security solutions that can detect ransomware behaviors, including sandboxing and AI-powered analysis.
Security Recommendations:
Organizations should also consider a multi-layered defense approach:
- Penetration Testing: Conduct internal penetration tests to identify vulnerabilities before attackers exploit them.
- Endpoint Security Solutions: Use solutions like Trend Vision One™ and Trend Micro Apex One™ for real-time threat detection and response.
- Data Protection: Implement data protection solutions, like Trend Micro Cloud One™, that offer virtual patching and machine learning-based threat detection.
Conclusion:
Despite positioning themselves as “penetration testers,” 8Base ransomware is a highly dangerous and financially motivated group. Their double extortion tactics and increasing activity pose a serious threat to SMBs across multiple sectors, particularly healthcare.
By adopting a proactive approach that includes phishing awareness, robust backup strategies, and endpoint protection, organizations can significantly reduce their risk of falling victim to 8Base ransomware. As always, staying vigilant and keeping systems updated will remain critical in defending against the evolving tactics of ransomware groups like 8Base.
