# What are Phobos and 8Base ransomware?

Phobos is a ransomware-as-a-service family active since about 2019, and 8Base was one of the groups that used a Phobos variant. CISA, the FBI and the MS-ISAC described Phobos in joint advisory AA24-060A of 29 February 2024: its affiliates targeted county and municipal governments, emergency services, education, health care and other critical infrastructure, typically getting in through remote-desktop services with weak or stolen passwords, or through phishing. Security researchers note that Phobos has mostly been used against small and mid-sized organisations rather than large enterprises. On 11 February 2025 Europol announced a coordinated international operation in which four people suspected of leading 8Base were arrested; the US Justice Department said it disrupted over 100 servers linked to the network. The advice for small companies is plain: do not expose remote desktop to the internet, enforce strong passwords and MFA for remote access, and keep offline backups.

FAQ: [Ransomware groups and families](https://netsenx.com/en/faq/ransomware-families) · https://netsenx.com/en/faq/what-are-phobos-and-8base-ransomware

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/blog/2026-10-24_ransomware-protection

## Related questions

- [What is Ghost, or Cring, ransomware?](https://netsenx.com/en/faq/what-is-ghost-cring-ransomware)
- [What is Interlock ransomware?](https://netsenx.com/en/faq/what-is-interlock-ransomware)
- [What is the difference between a ransomware family, a group and an affiliate?](https://netsenx.com/en/faq/difference-between-a-ransomware-family-group-and-affiliate)
- [What is ransomware as a service (RaaS)?](https://netsenx.com/en/faq/what-is-ransomware-as-a-service)
- [What is double extortion in ransomware?](https://netsenx.com/en/faq/what-is-double-extortion-ransomware)