8Base Ransomware Recovery: A Phobos Variant With a Free Decryptor

8Base was a ransomware group that used an encryptor based on Phobos, so its files carry the Phobos naming pattern with the .8base extension: name, .id[...] tag, attacker e-mail and .8base. Like other Phobos affiliates it mostly hit small and mid-size businesses through exposed Remote Desktop.

In February 2025 an international police operation took down the group's leak site and arrested suspected members. In July 2025 Japan's National Police Agency released a free decryptor for Phobos and 8Base, tested with the FBI and Europol, and published on No More Ransom.

Copy the encrypted files to another disk first, then run the official decryptor on the copies only. If some files do not decrypt, especially large SQL Server databases, virtual disks or backups, do not delete them: large files are often only partly encrypted, and the intact parts can be recovered directly.

We have recovered 8Base cases ourselves. We recover tables from encrypted MDF and BAK files and virtual machines from partly encrypted VMDK and VHDX files. Send a sample for a free assessment. No data, no charge.