Skip to main content
Darkfield

Operator dossier

8Base is a ransomware operator no longer publishing new disclosures. Darkfield has indexed 458 public victims claimed by this operator between May 23, 2023 and February 1, 2025. 8Base is a ransomware group that emerged in May 2023, operating with primarily financial motivations and demonstrating a rapid escalation in activity with 458 documented victims across multiple sectors. The group's origin and specific affiliations remain largely undocumented by major security agencies, though their operational patterns suggest they function as an independent ransomware operation targeting predominantly Western markets. Based on publicly available victim data, 8Base appears to focus on opportunistic attacks against business services and manufacturing sectors, with the United States representing their primary target geography, followed by France, Brazil, Italy, and the United Kingdom, indicating a preference for developed economies with established digital infrastructure. The group has notably impacted healthcare and technology sectors alongside their primary business services focus, suggesting a broad targeting approach rather than sector-specific specialization. Given the group's recent emergence in 2023 and continued victim accumulation across diverse geographic and sectoral targets, 8Base appears to remain active as of current reporting periods, though detailed technical methodologies, specific attack vectors, and notable high-profile campaigns have not been extensively documented in public threat intelligence reporting from major security agencies.

Most-targeted sectors

Most-affected countries

Recent disclosures by 8Base

Most recent 150 of 458 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for 8Base →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Inactive ransomware operator

← All groups

8Base

458 victims indexed · first seen 3 years ago · last activity 1 year ago

458
Victims indexed
#22 of 364 tracked operators
1y 9m
Active period
May 2023 → Feb 2025
10
Countries hit
top United States · 73

At a glance

Status
inactive
First seen
3 years ago
Last activity
1 year ago
Onion sites
4 known endpoints
Primary sector
Business Services · 50 hits

About

8Base is a ransomware group that emerged in May 2023, operating with primarily financial motivations and demonstrating a rapid escalation in activity with 458 documented victims across multiple sectors. The group's origin and specific affiliations remain largely undocumented by major security agencies, though their operational patterns suggest they function as an independent ransomware operation targeting predominantly Western markets. Based on publicly available victim data, 8Base appears to focus on opportunistic attacks against business services and manufacturing sectors, with the United States representing their primary target geography, followed by France, Brazil, Italy, and the United Kingdom, indicating a preference for developed economies with established digital infrastructure. The group has notably impacted healthcare and technology sectors alongside their primary business services focus, suggesting a broad targeting approach rather than sector-specific specialization. Given the group's recent emergence in 2023 and continued victim accumulation across diverse geographic and sectoral targets, 8Base appears to remain active as of current reporting periods, though detailed technical methodologies, specific attack vectors, and notable high-profile campaigns have not been extensively documented in public threat intelligence reporting from major security agencies.

References

10 links

External sources curated by the MISP threat-intel community.

Timeline

18 months
2023-05-01T00:00:00+00:00 · 672023-06-01T00:00:00+00:00 · 402023-07-01T00:00:00+00:00 · 392023-08-01T00:00:00+00:00 · 342023-09-01T00:00:00+00:00 · 222023-10-01T00:00:00+00:00 · 192023-11-01T00:00:00+00:00 · 352023-12-01T00:00:00+00:00 · 252024-01-01T00:00:00+00:00 · 292024-02-01T00:00:00+00:00 · 232024-03-01T00:00:00+00:00 · 172024-04-01T00:00:00+00:00 · 252024-05-01T00:00:00+00:00 · 212024-06-01T00:00:00+00:00 · 92024-10-01T00:00:00+00:00 · 132024-12-01T00:00:00+00:00 · 112025-01-01T00:00:00+00:00 · 252025-02-01T00:00:00+00:00 · 4
2023-05-01T00:00:00+00:002025-02-01T00:00:00+00:00

Top countries

🇺🇸 United States
73
🇫🇷 France
33
🇧🇷 Brazil
22
🇮🇹 Italy
21
🇬🇧 United Kingdom
19
🇩🇪 Germany
18
🇦🇺 Australia
15
🇪🇸 Spain
11
United States dossier →France dossier →Brazil dossier →Italy dossier →

Top sectors

Business Services
50
Manufacturing
38
Healthcare
17
Technology
12
Transportation/Logistics
10
Agriculture and Food Production
10
Education
8
Energy
6
Business Services dossier →Manufacturing dossier →Healthcare dossier →Technology dossier →

MITRE ATT&CK

3 techniques · 3 tactics

Tactics

Initial AccessExecutionImpact

Techniques

  • T1566Phishing
  • T1059Command and Scripting Interpreter
  • T1486Data Encrypted for Impact

Recent victims

Loading…

Onion infrastructure

4 known
  • http://92.118.36.204
  • http://basemmnnqwxevlymli5bs36o5ynti55xojzvn246spahniugwkff2pad.onion
  • http://xb6q2aggycmlcrjtbjendcnnwpmmwbosqaugxsqb4nx6cmod3emy7sad.onion
  • http://xfycpauc22t5jsmfjcaz2oydrrrfy75zuk6chr32664bsscq4fgyaaqd.onion

Source

Updated 1 year ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time 8Base posts a victim.

Add 8Base to your watchlist — Pro pings you within 5 minutes of any new 8Base leak-site post, Telegram callout, or affiliate-rebrand inference.