Europol Coordinates the Takedown of 8Base Ransomware, a Phobos Variant

Europol announced on February 11, 2025, that it had coordinated the dismantling of the 8Base ransomware gang earlier that month. This group relied on the infrastructure of the Phobos ransomware, using a more aggressive variant. Like Phobos, 8Base engaged in double extortion against small and medium-sized businesses, operating under a Ransomware-as-a-Service (RaaS) model.

The international police operation led to the arrest of four Russian nationals suspected of heading 8Base and the seizure of 27 servers. It also allowed authorities to warn more than 400 organizations worldwide that they were targeted in ongoing or planned attacks.

According to Europol, this operation is a continuation of previous actions against Phobos. In 2023, a French arrest warrant led to the capture of a key Phobos affiliate in Italy. In June 2024, law enforcement apprehended a Phobos administrator in South Korea, who was then extradited to the United States in November 2024.

“This complex international operation, supported by Europol and Eurojust, involved law enforcement agencies from 14 countries. Some focused on the Phobos investigation, others targeted 8Base, and several participated in both operations,” Europol stated in its press release.

In France, these operations were supported by the Paris Cybercrime Unit (BL2C) and the Junalco (National Jurisdiction for Combating Organized Crime). The other 13 countries involved were Germany, Belgium, Spain, the United States, Japan, Poland, Romania, the United Kingdom, Singapore, Sweden, Switzerland, Thailand, and the Czech Republic.