--- title: 8Base ransomware stays unseen for a year description: 8Base ransomware was first spotted in June 2023, with a massive number of targeted victims. It was later discovered that 8Base originated in March 2022 with the launch of an associated data leak site. canonical_url: https://www.acronis.com/en/tru/posts/8base-ransomware-stays-unseen-for-a-year/ locale: en last_updated: 2026-10-27 --- * [Home](https://www.acronis.com/en/tru/) * [Articles](https://www.acronis.com/en/tru/posts/) * [Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/) 17 July 2023 # 8Base ransomware stays unseen for a year 8Base ransomware was first spotted in June 2023, with a massive number of targeted victims. It was later discovered that 8Base originated in March 2022 with the launch of an associated data leak site. Author: **[Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/)** ## Summary * Comes to victims via SmokeLoader malware * Sample is a PE32 file, written in C\C++ * Modified version of Phobos ransomware * Encrypts users' files with AES-256-CBC cipher * Writes IV and encrypted AES key to the end of encrypted files * Data leak site shares similarities with the RansomHouse site ## Introduction 8Base ransomware was first spotted in June 2023, with a massive number of targeted victims. It was later discovered that 8Base originated in March 2022 with the launch of an associated data leak site. 8Base also has a Twitter account, which was created in 2014. In the account’s pinned post, the threat actors announced the publication of leaked data from the past year's operation, indicating that in addition to encrypting user files, the group has also exfiltrated data to its own servers. ![Image 1: 8Base ransomware stays unseen for a year](https://staticfiles.acronis.com/images/content/6996fe2991dfa627da1699ae3180cb56.png) To deliver 8Base ransomware to the victims' machines, threat actors used SmokeLoader, a botnet that is very popular for ransomware attacks. In addition to malware downloading capabilities, SmokeLoader also has a backdoor function that allows threat actors to exfiltrate victims' data. ## Technical details ### Overview The 8Base ransomware sample is a PE32 file, written in C\C++. The compilation timestamp ‘2022-06-23’ matches the start of gang operations. As was mentioned before, its activity was spotted only in June 2023, so this sample remained unseen until this moment. ![Image 2: 8Base ransomware stays unseen for a year](https://staticfiles.acronis.com/images/content/f197d3a7ff9086c9f8ec085fd77161b4.png) ### Execution At the start of execution, 8Base decrypts some executable code, loads it to the ‘eax’ register, and calls it. ![Image 3: 8Base ransomware stays unseen for a year](https://staticfiles.acronis.com/images/content/ea41fae8c1695707d265da16213303ae.png) While the sample file doesn't have a lot of imports, during execution, it loads separated parts of import names and saves them to local variables for further use. ![Image 4: 8Base ransomware stays unseen for a year](https://staticfiles.acronis.com/images/content/b176904ef947d18482291ad0fad7e53a.png) Here are some imports used to work with files, loaded during execution: _kernel32\_FindClose_ _kernel32\_FindNextFileW_ _kernel32\_SystemTimeToFileTime_ _kernel32\_FindFirstFileW_ _kernel32\_MoveFileW_ _kernel32\_GetFileSizeEx_ _kernel32\_SetFilePointerEx_ _kernel32\_SetEndOfFile_ _kernel32\_SetFilePointer_ _kernel32\_GetLogicalDrives_ _kernel32\_CopyFileW_ _kernel32\_GetFileAttributesW_ _kernel32\_ReadFile_ _kernel32\_WriteFile_ 8Base then loads the mutex name and checks if it already exists. If so, it will terminate execution; if not, it creates a mutex and a new process of itself with the ‘CreateProcessW’ function. ![Image 5: 8Base ransomware stays unseen for a year](https://staticfiles.acronis.com/images/content/222708adaa35a84718161e6bceecea98.png) ![Image 6: 8Base ransomware stays unseen for a year](https://staticfiles.acronis.com/images/content/aaecb30c76116f8e06698aa5338888c4.png) Before encrypting files, 8Base takes some preparatory steps. First, it copies itself to three different folders on the system: _C:\Users\Flare\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup_ _C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\mtx777.exe_ _C:\Users\Flare\AppData\Local\mtx777.exe_ Next, it creates new Registry keys to enable itself to auto-start: _HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mtx777_ _HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mtx777_ It modifies some keys, responsible for internet policy: _HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass 1_ _HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName 1_ _HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet 1_ _HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect 0_ 8Base then uses the ‘Wow64DisableWow64FsRedirection’ function to disable file system redirection. It executes some commands to delete shadow copies, backup catalogs, change BootStatusPolicy and disable Recovery Mode. _vssadmin delete shadows /all /quiet_ _wmic shadowcopy delete_ _bcdedit /set {default} bootstatuspolicy ignoreallfailures_ _bcdedit /set {default} recoveryenabled no_ _wbadmin delete catalog -quiet_ It also executes the following commands to disable the firewall: _netsh advfirewall set currentprofile state off_ _netsh firewall set opmode mode=disable_ ### File encryption 8Base begins searching for available drives on the system with ‘GetLogicalDrives’ and obtains information about them. ![Image 7: 8Base ransomware stays unseen for a year](https://staticfiles.acronis.com/images/content/79ca92768c929a795c7e5b3006acd539.png) Then it starts creating encryption threads: ![Image 8: 8Base ransomware stays unseen for a year](https://staticfiles.acronis.com/images/content/13d2edb997e477f6481ab8ee6c2ea8db.png) To search files on the drive, 8Base uses the ‘FindFirstFileW’ and ‘FindNextFileW’ functions. During encryption, it skips the ‘C:\Windows’ folder, files with its own extension, and ransom note files. Other found files are given to the encryption thread. ![Image 9: 8Base ransomware stays unseen for a year](https://staticfiles.acronis.com/images/content/2729dd88dcd16d3fd41106408d8e6919.png) The encryption thread opens the file, gets its attributes, and reads its context. ![Image 10: 8Base ransomware stays unseen for a year](https://staticfiles.acronis.com/images/content/e0ed9651d91466ffe43a60006f770ff7.png) Before starting encryption, 8Base creates a new file with a new extension: _.id[].[].8base_ ![Image 11: 8Base ransomware stays unseen for a year](https://staticfiles.acronis.com/images/content/160274c1e5c35ac41e9fa99aedaca7cb.png) ![Image 12: 8Base ransomware stays unseen for a year](https://staticfiles.acronis.com/images/content/3b4c16ecd83b0dc524fddae28a62c28c.png) Next, it transfers data to the encryption function, which uses the AES-256 algorithm in CBC mode. The IV keys are generated randomly during execution and will later be written to the encrypted file. To encrypt the AES key, it uses the RSA algorithm, making this encryption pretty strong. The encryption algorithms are hardcoded and don't use any crypto imports. ![Image 13: 8Base ransomware stays unseen for a year](https://staticfiles.acronis.com/images/content/b915019da12171da27308147b9bfd6f2.png) After encrypted data is written, 8Base takes one further step — it encrypts the AES key and writes it to the end of the file with the IV key. ![Image 14: 8Base ransomware stays unseen for a year](https://staticfiles.acronis.com/images/content/a8dc0d8bccb7481bf1dcf7589f547ccc.png) ![Image 15: 8Base ransomware stays unseen for a year](https://staticfiles.acronis.com/images/content/993955f4dd1396d1d4eb1420beb307f9.png) With the encryption process completed, we can analyze the file structure. The first written data in the file is encrypted data. Next, there is a block of data, which is typical for Phobos family ransomware. First, there are 20 bytes of ‘00’ (red line), which are used as a separator between encrypted data and this block. Then there are 16 bytes of IV key, which is different for each encrypted file (green line). Finally, the last block (yellow lines) is an encrypted AES key, which is similar for all files, encrypted in one session. ![Image 16: 8Base ransomware stays unseen for a year](https://staticfiles.acronis.com/images/content/eac88f850debaf08bf9be39bd80d34c8.png) ### Ransom note The ransom note files ‘info.hta’ and ‘info.txt’ are dropped after the completed encryption process in ‘C:\’ and ‘C:\User\User\Desktop.’ ![Image 17: 8Base ransomware stays unseen for a year](https://staticfiles.acronis.com/images/content/6521290215258f92c8c5fef9de527e20.png) ![Image 18: 8Base ransomware stays unseen for a year](https://staticfiles.acronis.com/images/content/9faa978134a4dd75705fed407b99ec21.png) ### Data leak site While the ransom notes don’t have a link to the data leak site, the threat actor’s Twitter account does: http://basemmnnqwxevlymli5bs36o5ynti55xojzvn246spahniugwkff2pad.onion/ This site contains the main page with the most recent victims of 8Base ransomware, a page for contacting the threat actors, a FAQ, and a “Rules” page. ![Image 19: 8Base ransomware stays unseen for a year](https://staticfiles.acronis.com/images/content/f332bdbc868f254aaab456f34c264f2a.png) ![Image 20: 8Base ransomware stays unseen for a year](https://staticfiles.acronis.com/images/content/8733f121a1ed8804148e9c5df3e26240.png) The data leak site shares a lot of similarities to the RansomHouse group site, but it is still not clear whether these two groups are connected to each other or whether the 8Base threat actors have simply borrowed their site design. ## Conclusion 8Base ransomware successfully stayed unseen for almost a year before it was spotted with a large spike of targeted victims. On their Twitter account, the threat actors actively publish news, including info about recently breached victims. The sample that was analyzed is a customized version of the Phobos ransomware, which encrypts users' files with AES-256-CBC algorithm, and utilizes SmokeLoader to bring malware to targeted systems. The most interesting question here is about a potential connection between 8Base and another ransomware group (RansomHouse), as their data leak sites share a lot of similarities. ## Detected by Acronis ![Image 21: 8Base ransomware stays unseen for a year](https://staticfiles.acronis.com/images/content/2fe9724b1789794b23f5a41887f42732.png) ## IoCs ### Files **File name** **SHA256** mtx777.exe 518544e56e8ccee401ffa1b0a01a10ce23e49ec21ec441c6c7c3951b01c1b19c ### Network indicators **URL** **Description** http://basemmnnqwxevlymli5bs36o5ynti55xojzvn246spahniugwkff2pad.onion/ Data leak site https://twitter.com/8BASEHOME Threat actor Twitter account Related articles [The Gentlemen: A closer look at a not-so-gentle ransomware-as-a- service operation](https://www.acronis.com/en/tru/posts/the-gentlemen-a-closer-look-at-a-not-so-gentle-ransomware-as-a-service-operation/) [Acronis AI Copilot: Adoption is high and growing among MSPs](https://www.acronis.com/en/tru/posts/acronis-ai-copilot-adoption-is-high-and-growing-among-msps/) [Acronis Cyberthreats Update, October 2026](https://www.acronis.com/en/tru/posts/acronis-cyberthreats-update-october-2026/) [AI agents at work: What Acronis endpoint data reveals about MSP and SMB usage](https://www.acronis.com/en/tru/posts/ai-agents-at-work-what-acronis-endpoint-data-reveals-about-msp-and-smb-usage/)