8Base attacks GPI Corporate
Incident Date:
April 15, 2024
Overview
Title
8Base attacks GPI Corporate
Victim
GPI Corporate
Attacker
8base
Location
First Reported
April 15, 2024
Ransomware Group 8Base Attacks GPI Corporate
Background
Ransomware group 8Base has attacked GPI Corporate, a fully integrated promotional marketing solution provider based in Australia with an office in Hong Kong. GPI Corporate delivers fresh ideas, creative products, and solutions to enhance efficiencies and promote growth.
8Base Ransomware Gang
The 8Base ransomware gang emerged in March of 2022 and has become one of the most active groups today, showing a "massive spike in activity" in the second half of 2023. About half of 8Base targets are in business services, manufacturing, and construction sectors.
Connection to Ransomhouse
8Base is believed to be an offshoot of experienced RaaS operators, possibly connected to Ransomhouse, a data extortion group that first appeared in December of 2021. Other researchers suggest a link to the leaked Babuk builder.
Operational Tactics
8Base engages in data exfiltration for double extortion and uses advanced security evasion techniques, such as modifying Windows Defender Firewall for bypass. They utilize a variety of ransomware payloads and loaders, including customized Phobos with SmokeLoader, and wipe Volume Shadow Copies (VSS) to prevent encryption rollback.
Targeted Sectors
8Base primarily targets organizations in business services, manufacturing, financial, and information technology sectors. They focus on Windows systems and use a "name and shame" tactic via their leaks site to compel ransom payment.
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.