
On February 11, international law enforcement agencies officially dismantled the 8Base ransomware group, which targeted businesses around the world. Four members of the group were arrested in Thailand and their servers were seized as part of a joint investigation by police in Europe, the United States, Switzerland and other countries.
Police have dismantled one of the most active ransomware groups in recent years. Operation PHOBOS AETOR took place in Phuket, Thailand, where police arrested two men and a woman from Europe. They are accused of extorting cryptocurrency and stealing $16 million in BTC through attacks on more than 1,000 victims worldwide, including 17 companies in Switzerland.
Police seized more than 40 digital devices, including laptops, smartphones and digital wallets. The detainees will be extradited to Switzerland, where they will stand trial for conspiracy to commit cybercrimes.
8Base has been operating since 2022 and was among the top ten hacking groups after LockBit; in the first half of 2023, they carried out 67 attacks, which is 15% of all ransomware attacks. The victims were companies from the technology, financial, transportation and agricultural sectors. The last known attack was dated January 3, 2025. The group’s Telegram channel published details of the victims, including Brazilian manufacturer Grupo Buddemeyerl and French law firm Voltaire Avocats. Interestingly, 8Base had strict “rules of the game” that prohibited victims from involving third parties in negotiations, in order to prevent the ransom amount from being reduced.
The arrest of 8Base once again confirms the effectiveness of international cooperation in the fight against cybercrime. However, experts warn that such groups are quickly emerging under new names and that the fight against cybercriminals is far from over.