Malware
8Base
The 8Base ransomware group has remained relatively unknown despite the massive spike in activity in Summer of 2023. The group utilizes encryption paired with “name-and-shame” techniques to compel their victims to pay their ransoms. 8Base has an opportunistic pattern of compromise with recent victims spanning across varied industries. Despite the high amount of compromises, the information regarding identities, methodology, and underlying motivation behind these incidents still remains a mystery. Samples of their ransomware show they are using customized Phobos with SmokeLoader.
Indicators of Compromise 35
Domain authorized-logins[.]net Domain b6w9m2z5x8q1v3k[.]top Domain datalayerservice[.]com Domain devminelimited[.]com Domain doctecsolutions[.]com Domain microsoft[.]desereyunton[.]workers[.]dev Domain rebronzeal[.]com Domain strapness[.]com Domain summonhood[.]com Domain technodatabase[.]net Filename accumulatally.ps1 Filename earthquakeist.ps1 Filename evasion.node SHA-256 164cad33a0b076a6d01263e159ad06d2e7b1e9e1ace43294c252b11699022485 SHA-256 1e41c7bfaa6aa3b93b6cc024274a10e33f3e12fe7c98c1db387ef8927f9d1984 SHA-256 232b5115f4b78fe01c6497b1039b85ee57f6a58abd095dc80ea4d3c5e6cef6d6 SHA-256 24d71cb6cf6d34871031564c3f104195b812f8e72ceffb1f0ce1936998531e6f SHA-256 34d798a6c55e57ed0932b6499f4fbcb5454bdfca903307be101a0594b0ac07bc SHA-256 3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be SHA-256 59e3c4cb06331b4f2d78a9a0592f3747e573bd01c5a7650c26361d1e25520712 SHA-256 8c935feec4bd05d5d918df308be417532fb42608fb989a08eab183e0ae699235 SHA-256 afd5f1ed45a9867daf3bc64152cef460a06b164c8183e490db39146d4749a82c SHA-256 c854382d457eddbae9887350f9f19a2bc35c02968900b8f534503d0dcbd824a5 SHA-256 cd211247d1c1c1ca4d77418fea60efafd0736017ef35c9191aed85c684adc153 SHA-256 d965de63dbd27abb00efeb9bea029cd38952dc5c268b61a522b2358d8452e43a SHA-256 db972979d508e75fe730d3b72c2701470fbdaeaf8ebdd674744754fa44438ca5 SHA-256 e237801a9ef693d0d4c7d148965bb50c90946b43b8b9e00aa5e39fe5393a26e9 SHA-256 e901df53873d5379ad9399c63d3e014c7be188a7599b32e5b36b1de1cf7d5fba SHA-256 f591275a8f014b29e567529d67c54eb7bb4473db1c38737d6bfd5b3d52c9344e SHA-256 fb3630822b70bacb56aa4cec29b5a0e3e9acb3920809e70310a4003385a6d34a IP 142[.]93[.]242[.]144 IP 144[.]31[.]53[.]78 IP 198[.]13[.]159[.]44 IP 199[.]91[.]221[.]42 IP 45[.]158[.]196[.]23
MITRE ATT&CK TTPs 7
Source Articles
Node.js: Old Technique Makes a Comeback
Multiple threat actors have revived the abuse of Node.js to evade detection by executing malicious JavaScript payloads through the legitimate, signed node.exe runtime. The attacks, observed since February 2026, targeted government departments, technology companies, and hotels. In one campaign, attackers used a ClickFix-style lure to deploy PowerShell scripts, established persistence, and leveraged Node.js to connect to Ethereum blockchain gateways (EtherHiding) for command retrieval. A related intrusion involved the deployment of a Rust-based backdoor, C2Looper, linked to ransomware operations. The same actors used shared infrastructure, including the C2 domain datalayerservice[.]com and IP 45.158.196[.]23:8888, across multiple victims.
security-com ·1w ago
Backdoor.Mistic: New Backdoor May be Linked to Ransomware Access Broker
Backdoor.Mistic is a newly identified stealthy memory-resident backdoor used in cybercrime intrusions since April 2026. It has been deployed alongside ModeloRAT, a Python-based RAT linked to the financially motivated threat actor Woodgnat (aka KongTuke), known for selling initial access to ransomware affiliates including Qilin, Black Basta, and Rhysida. Mistic is sideloaded via legitimate binaries like MpExtMs.exe and loads malicious DLLs such as EndpointDlp.dll, enabling fileless execution, in-memory payload loading, and self-deletion via a kill switch. The actor uses social engineering lures (ClickFix, FileFix, CrashFix) and Microsoft Teams for initial access, with opportunistic targeting across insurance, education, IT, and professional services sectors.
security-com ·2mo ago