8Base primarily uses phishing scams with malicious links for initial access and, as most ransomware groups, relies on a variety or system utilities, third-party hacking tools and malicious programs: Mimikatz, LaZagne, PasswordFox, KILLAV, SmokeLoader, SystemBC, PCHunter, GMER, Process Hacker and more. The custom Phobos file encryptor used by the group appends the .8base extension to encrypted files.
8Base has managed to compromise organizations from many industries, including manufacturing, finance, legal services, construction, healthcare, but a large number of its victims are small businesses with under 200 employees.
Akira
Akira is a group that first appeared in April 2023 and was thought to be an offshoot of the defunct Conti group because its file encryptor shared many code similarities with Conti’s ransomware program. However, the code of Conti’s file encryptor was leaked so this is not necessarily a strong link, but a blockchain analysis also uncovered potential links to the Conti operation.
