What are Phobos and 8Base ransomware?

Phobos is a ransomware-as-a-service family active since about 2019, and 8Base was one of the groups that used a Phobos variant. CISA, the FBI and the MS-ISAC described Phobos in joint advisory AA24-060A of 29 February 2024: its affiliates targeted county and municipal governments, emergency services, education, health care and other critical infrastructure, typically getting in through remote-desktop services with weak or stolen passwords, or through phishing. Security researchers note that Phobos has mostly been used against small and mid-sized organisations rather than large enterprises. On 11 February 2025 Europol announced a coordinated international operation in which four people suspected of leading 8Base were arrested; the US Justice Department said it disrupted over 100 servers linked to the network. The advice for small companies is plain: do not expose remote desktop to the internet, enforce strong passwords and MFA for remote access, and keep offline backups.

← All 25 questions on Ransomware groups and familiesAll topics