8Base
Attribution profile
- Type
- Crime Syndicate
- Location
- Italy
- Known incidents
- 8 incidents
- Sources
- 3 sources
- First seen
- 2023-05-23
- Last seen
- 2024-12-01
- Updated
- 2026-10-04 00:08
- Aliases
- 1 alias
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
8Base, also known as 8Base, is a ransomware group whose activity has been traced to Italy. The group has carried out ransomware and data‑extortion attacks against a range of sectors including maritime logistics (Port of Rijeka), agricultural unions (FWA), fisheries commissions (Atlantic States Marine Fisheries Commission), retail grocery chains (Östenssons), software providers (Swiss network‑monitoring firm), and legal services firms (Legalilavoro, Studio Legale Ranchino, SiComputer) across Europe and the United States. Their typical tactic involves deploying ransomware—often linked to the Phobos and RansomHouse families—to encrypt systems and exfiltrate data, followed by a double‑extortion threat to publish the stolen information unless a payment is made, accompanied by a countdown timer on their darknet leak site. They present themselves as “honest pentesters” offering fair terms for data return, while using externally developed infrastructure and a vulnerable chat function tied to a Moldovan programmer. Public reporting notes that their leak site excludes victims from Russia and former Soviet states, suggesting a Russian affiliation, and they share stylistic similarities with the RansomHouse operation. Notable publicly reported operations include the December 2024 attack on the Port of Rijeka, the January 2024 breach of a Swiss software company serving European telecom providers, and the June 2023 ransomware claim against the Italian legal firm Legalilavoro.
Incidents
Attributed incidents are available to members.
8 incidentsSources
Sources available to members: 3 sources.