← Back to 8base profile

8base — Ransom Notes

These are the actual ransom notes used by the 8base ransomware group when communicating with victims. Ransom notes are left on compromised systems to inform victims of the attack and provide instructions for payment. Studying these notes helps security professionals understand threat actor tactics and communication patterns.
Disclaimer: These notes are displayed for educational and research purposes only. The URLs and contact methods mentioned in these notes are operated by criminal organizations. Do not interact with them. Source: Ransomware.live
📄 8base_note
Dear Management, If you are reading this message, it means that: - your network infrastructure has been compromised, - critical data was leaked, - files are encrypted -------------------------------------------------------------------------- The best and only thing you can do is to contact us to settle the matter before any losses occurs. Onion Site: http://basemmnnqwxevlymli5bs36o5ynti55xojzvn246spahniugwkff2pad.onion/ Telegram Channel: https://t.me/eightbase -------------------------------------------------------------------------- 1. THE FOLLOWING IS STRICTLY FORBIDDEN 1.1 EDITING FILES ON HDD. Renaming, copying or moving any files could DAMAGE the cipher and decryption will be impossible. 1.2 USING THIRD-PARTY SOFTWARE. Trying to recover with any software can also break the cipher and file recovery will become a problem. 1.3 SHUTDOWN OR RESTART THE PC. Boot and recovery errors can also damage the cipher. Sorry about that, but doing so is entirely at your own risk. -------------------------------------------------------------------------------------------------- 2. EXPLANATION OF THE SITUATION 2.1 HOW DID THIS HAPPEN The security of your IT perimeter has been compromised (it's not perfect at all). We encrypted your workstations and servers to make the fact of the intrusion visible and to prevent you from hiding critical data leaks. We spent a lot of time researching and finding out the most important directories of your business, your weak points. We have already downloaded a huge amount of critical data and analyzed it. Now its fate is up to you, it will either be deleted or sold, or shared with the media. 2.2 VALUABLE DATA WE USUALLY STEAL: - Databases, legal documents, personal information. - Audit reports. - Audit SQL database - Any financial documents (Statements, invoices, accounting, transfers etc.). - Work files and corporate correspondence. - Any backups. - Confidential documents. 2.3 TO DO LIST (best practies) - Contact us as soon as possible. - Contact us only in our live chat, otherwise you can run into scammers. - Purchase our decryption tool and decrypt your files. There is no other way to do this. - Realize that dealing with us is the shortest way to success and secrecy. - Give up the idea of using decryption help programs, otherwise you will destroy the system permanently. - Avoid any third-party negotiators and recovery groups. They can become the source of leaks. -------------------------------------------------------------------------------------------------- 3. POSSIBLE DECISIONS 3.1 NOT MAKING THE DEAL - After 4 days starting tomorrow your leaked data will be Disclosed or sold. - We will also send the data to all interested supervisory organizations and the media. - Decryption key will be deleted permanently and recovery will be impossible. - Losses from the situation can be measured based on your annual budget. 3.2 MAKING THE WIN-WIN DEAL - You will get the only working Decryption Tool and the how-to-use Manual. - You will get our guarantees (with log provided) of non-recovarable deletion of all your leaked data. - You will get our guarantees of secrecy and removal of all traces related to the deal in the Internet. - You will get our security report on how to fix your security breaches. -------------------------------------------------------------------------------------------------- 4. EVIDENCE OF THE LEAKAGE In our contact form or mail: http://basemmnnqwxevlymli5bs36o5ynti55xojzvn246spahniugwkff2pad.onion/contact [email protected] [email protected] -------------------------------------------------------------------------------------------------- 5. HOW TO CONTACT US 5.1 Download and install TOR Browser https://torproject.org 5.2 Go to our contact form website at http://basemmnnqwxevlymli5bs36o5ynti55xojzvn246spahniugwkff2pad.onion/contact 5.3 You can request sample files chat to review leaked data samples. 5.4 In case TOR Browser is restricted in your area use VPN services. 5.5 All leaked Data samples will be Disclosed in 4 Days if you remain silent. 5.6 Your Decryption keys will be permanently destroyed at the moment the leaked Data is Disclosed. -------------------------------------------------------------------------------------------------- 6. RESPONSIBILITY 6.1 Breaking critical points of this offer will cause: - Deletion of your decryption keys. - Immediate sale or complete Disclosure of your leaked data. - Notification of government supervision agencies, your competitors and clients. --------------------------------------------------------------------------------------------------
📄 READ_NOTE
<html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; word-break: break-all; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">[snip]</span> <br> <!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <div id="tab-content1" class="content"> <div class="text"> <!--text data --> <b>Hello dear management, [snip]</b><br> <b>All your important files have been encrypted!</b><br><br> <hr> Your files are safe! Only modified. (RSA+AES)<br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br><br> No software available on internet can help you. We are the only ones able to<br> solve your problem.<br><br> From your file storage, we have downloaded a large amount of confidential data of your company and personal data.<br> <b>Data leakage</b> will entail great reputational risks for you, we would not like that.<br> <b><i>In case you do not contact us</i></b>, we will initiate an auction for the sale of <b>personal and confidential data.</b><br><br> After the auction is over, we will place the data in public access on <b>our blog.</b><br> <i>The link is left at the bottom of the note.</i><br><br> This server will be immediately destroyed after your payment.<br> If you decide to not pay, we will release your data to public or re-seller.<br> So you can expect your data to be publicly available in the near future..<br><br> We only seek money and our goal is not to damage your reputation or prevent<br> your business from running.<br><br> You will can send us 2-3 non-important files and we will decrypt it for free<br> to prove we are able to give your files back.<br><br> <!--text data --> <hr> <b>Contact us for price and get decryption software.</b><br><br> <hr> <b>email:</b><br> <a href="[email protected]">[email protected]</a> <br> <a href="[email protected]">[email protected]</a> <br> <p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br> <b> IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br> <p>* Tor-chat to always be in touch: <a href<a href<b> http://xfycpauc22t5jsmfjcaz2oydrrrfy75zuk6chr32664bsscq4fgyaaqd.onion </div> </div> </div> <!--tab--> <b> </b><br><br> </b><br> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html>