Four Russian nationals behind 8Base ransomware arrested, says Europol

Four Russian nationals leading the 8Base ransomware group were arrested last week, Europol announced Tuesday.

The individuals are suspected of deploying a variant of the ransomware known as Phobos to extort high-value payments from victims across Europe and beyond.

8Base is a relatively new ransomware operation that intensified its activities in the summer of 2023. The group has since claimed responsibility for high-profile attacks on the United Nations Development Programme and the Atlantic States Marine Fisheries Commission.

Phobos ransomware was first detected in 2018. Unlike other high-profile ransomware groups that target large corporations, Phobos relies on high-volume attacks against small to medium-sized businesses that often lack the necessary cybersecurity defences to protect themselves.

The Phobos model has allowed criminal actors — from individual affiliates to structured criminal groups such as 8Base — to customise their ransomware campaigns with minimal technical expertise.

The leak site for the 8base ransomware was taken down by authorities on Monday, subsequently displaying a seizure banner.

Europol stated that the complex international operation involved 14 coordinated law enforcement agencies. While some countries focused on the investigation into Phobos, others targeted 8Base. At the same time, 27 servers linked to the criminal network were taken down.

This news follows a series of previous high-impact arrests which have targeted Phobos ransomware, with a key Phobos affiliate arrested in Italy on a French arrest warrant in 2023.

As a result of this operation, law enforcement authorities were also able to warn more than 400 companies worldwide of ongoing or imminent ransomware attacks.