8Base ransomware members snared in global police crackdown
The group is believed to have targeted more than 1,000 organizations around the world


Four Russian nationals have been arrested for their alleged involvement in the 8Base ransomware group after a joint police operation by 14 countries.
The suspects were arrested in Phuket, Thailand, and charged with a number of offenses, potentially carrying decades in prison. At the same time, 27 servers linked to the criminal network were taken down.
The gang was deploying a variant of Phobos ransomware to extort large payments from victims across Europe, the US, and beyond, authorities said.
First detected in December 2018, Phobos ransomware has been widely used in large-scale attacks against businesses and organizations worldwide.
8Base is believed to have targeted more than 1,000 public and private bodies, raking in more than $16 million in ransom payments in all.
"Unlike high-profile ransomware groups that target major corporations, Phobos relies on high-volume attacks against small to medium-sized businesses, which often lack the cybersecurity defences to protect themselves," said Europol.
"Its Ransomware as a Service (RaaS) model has made it particularly accessible to a range of criminal actors, from individual affiliates to structured criminal groups such as 8Base."
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
8Base developed its own variant of the ransomware, using its encryption and delivery mechanisms to tailor attacks and cause the biggest impact possible.
Who are 8Base?
It has been particularly aggressive in its use of double extortion techniques, which involve both encrypting victims' data and threatening to publish stolen information unless a ransom is paid.
As a result, the group has been the focus of action by international law enforcement for a while. A key Phobos affiliate was arrested in Italy in 2023, for example, while last summer an administrator was arrested in South Korea and extradited to the US.
Two of the four people arrested this week have now been charged in the US for their part in the group: Roman Berezhnoy, 33, and Egor Nikolaevich Glebov, 39, both of whom are Russian nationals.
They are accused of carrying out ransomware attacks between May 2019 and at least October 2024. Victims are believed to include a children’s hospital, health care providers, and educational institutions.
RELATED WHITEPAPER
"After a successful Phobos ransomware attack, criminal affiliates paid fees to Phobos administrators for a decryption key to regain access to the encrypted files," said the US Department of Justice.
"Each deployment of Phobos ransomware was assigned a unique alphanumeric string in order to match it to the corresponding decryption key, and each affiliate was directed to pay the decryption key fee to a cryptocurrency wallet unique to that affiliate."
The UK's National Crime Agency (NCA) said the group had had a significant impact on the UK and that, as a result of the investigation, it was able to prevent a number of targeted businesses from falling victim to encryption.
MORE FROM ITPRO
- The hidden cost of ransomware is way more painful than many realize
- How to deal with ransomware remediation
- UK firms are dangerously overconfident about paying ransoms
Emma Woollacott is a freelance journalist writing for publications including the BBC, Private Eye, Forbes, Raconteur and specialist technology titles.
-
AI coding tools are booming – and developers in this one country are by far the most frequent users
News AI coding tools are soaring in popularity worldwide, but developers in one particular country are among the most frequent users.
-
Cisco warns of critical flaw in Unified Communications Manager – so you better patch now
News While the bug doesn't appear to have been exploited in the wild, Cisco customers are advised to move fast to apply a patch
-
A prolific ransomware group says it’s shutting down and giving out free decryption keys to victims – but cyber experts warn it's not exactly a 'gesture of goodwill'
News The Hunters International ransomware group is rebranding and switching tactics
-
Swiss government data published following supply chain attack – here’s what we know about the culprits
News Radix, a non-profit organization in the health promotion sector, supplies a number of federal offices, whose data has apparently been accessed.
-
Ransomware victims are getting better at haggling with hackers
News While nearly half of companies paid a ransom to get their data back last year, victims are taking an increasingly hard line with hackers to strike fair deals.
-
LockBit data dump reveals a treasure trove of intel on the notorious hacker group
News An analysis of May's SQL database dump shows how much LockBit was really making
-
‘I take pleasure in thinking I can rid society of at least some of them’: A cyber vigilante is dumping information on notorious ransomware criminals – and security experts say police will be keeping close tabs
News An anonymous whistleblower has released large amounts of data allegedly linked to the ransomware gangs
-
It's been a bad week for ransomware operators
News A host of ransomware strains have been neutralized, servers seized, and key players indicted
-
Everything we know about the Peter Green Chilled cyber attack
News A ransomware attack on the chilled food distributor highlights the supply chain risks within the retail sector
-
SonicWall CEO Bob VanKirk hails ‘pivotal moment’ as firm unveils new MSP cyber solutions
News The company is expanding its MSP solutions range and ramping up its focus on platform-based security