Brewer Davidson Targeted by 8Base Ransomware Group

Brewer Davidson has allegedly been compromised by the 8Base ransomware group. The reported breach involves sensitive information such as invoices, receipts, accounting documents, personal data, certificates, employment contracts, confidentiality agreements, and personal files. A ransom deadline of 20 March has been given. Brewer Davidson is an architectural firm formed in 1993 by Kevin Brewer and Peter Davidson as a partnership. In the intervening years, the company has grown to 23 staff members, comprised of architects, architectural designers, and urban designers. Its experience includes education, healthcare, and commercial buildings, retail fit-outs, new homes and alterations, urban design, and master planning.

The Rise of 8Base Ransomware Gang

The 8Base ransomware gang first emerged in March of 2022 and has quickly become one of the most active groups today, having displayed a "massive spike in activity" in the second half of 2023. About half of the 8Base targets are in the business services, manufacturing, and construction sectors. The sophistication of the operation suggests they are an offshoot of experienced RaaS operators - most likely Ransomhouse, a data extortion group that first emerged in December of 2021 and was quite active in late 2022 and early 2023. Other researchers see a connection to the leaked Babuk builder.

Like most groups today, 8Base engages in data exfiltration for double extortion and employs advanced security evasion techniques, including modifying Windows Defender Firewall for bypass. 8Base quickly ascended the ranks of active ransomware operators with a high volume of attacks in late spring and throughout the summer of 2023, making them one of the most active groups. It is unclear how much 8Base typically demands for a ransom. 8Base does not appear to have its own signature ransomware strain or maintain a RaaS for recruiting affiliate participation openly, but it is assessed it may service a group of vetted affiliate attackers privately.

Like RansomHouse, they appear to use a variety of ransomware payloads and loaders in their attacks, most prevalently customized Phobos with SmokeLoader. Attacks also include wiping of Volume Shadow Copies (VSS) to prevent rollback of the encryption. 8Base does not appear to be targeting Linux systems, but it maintains a focus on Windows targets. 8Base tends to target organizations that provide Business Services as well as those in the Manufacturing, Financial, and Information Technology sectors. 8Base does not appear to maintain a RaaS program, appearing to be opportunistic in their choice of victims, with a focus on “name and shame” via their leaks site to compel payment of the ransom demand.