Cybersecurity report

# 8Base Ransomware: In-Depth Analysis, Detection, and Mitigation

SentinelOne, July 28, 2023. SentinelOne's tracking of 8Base through and past the February 2025 Operation PHOBOS AETOR disruption, recording it as the most comprehensive action to date against Phobos/8Base and noting no rebrand or successor carrying the operation forward..

**Source type:** Cybersecurity report

**Published:** July 28, 2023

**Research grade:** T2

**Used in entries:** 1

## Bibliographic record

**Publisher:** SentinelOne

**Published:** July 28, 2023

**Source type:** Cybersecurity report

**Research grade:** Source grade T2

**Language:** English

**Official record:** Not an official publication

**Address:** [https://www.sentinelone.com/anthology/8base/](https://www.sentinelone.com/anthology/8base/)

**What it supports:** SentinelOne's tracking of 8Base through and past the February 2025 Operation PHOBOS AETOR disruption, recording it as the most comprehensive action to date against Phobos/8Base and noting no rebrand or successor carrying the operation forward.

**Dataset id:** src\_sentinelone\_8base\_anthology

## Research notes

- JSON-LD datePublished 2023-07-28T20:53:33Z, dateModified 2025-09-17T08:25:06Z; the page itself prints 'Published: July 28, 2023 Last updated: September 17, 2025'.
- This is a living reference entry in SentinelOne's Ransomware Anthology, not a dated report - published\_on is the original publication date and its content reflects the September 2025 revision.
- The page states 8Base has only surface-level similarity to Phobos, RansomHouse and Hive with no corroborated formal ties - do not read a lineage into it.

How this source is used

Cited 1 time across 1 record type.

The role on each citation records what the source was relied on for. A primary source establishes the fact, a supporting source corroborates it, technical evidence describes the infrastructure, and a later outcome records what happened afterwards.

Sources were reviewed to a research cutoff of August 23, 2026. Addresses recorded after that date are not reflected here.

## Cited by

### Later activity

1 citation

Cited for activity recorded after the takedown.

-
[No documented return](https://takedownindex.org/takedowns/phobos-8base-ransomware-disruption)

Relationship not established, Phobos/8Base ransomware disruption

Background

[All sources](https://takedownindex.org/sources)