8Base

┌──────────────────────────────────────────────────────┐
│           8Base 关联组织网络                            │
├──────────────────────────────────────────────────────┤
│                                                        │
│  Phobos RaaS（上游提供者）                             │
│  ├── 提供加密工具和基础设施                            │
│  ├── 8Base 为 "Affiliate 2803"                        │
│  │                                                      │
│  └──→ 8Base（2022.03-2025.02）                        │
│       ├── 修改 Phobos 构建工具                         │
│       ├── .8base 扩展名                                │
│       ├── 自定义勒索信                                 │
│       │                                                │
│       └── RansomHouse（99%勒索信匹配）                 │
│            措辞逐字复制，可能共用开发者                  │
│                                                        │
└──────────────────────────────────────────────────────┘

netsh advfirewall set currentprofile state off
vssadmin.exe delete shadows /all /quiet
wmic shadowcopy delete

钓鱼邮件 / IAB 购买
    ↓
SmokeLoader（解包加载）
    ↓
SystemBC（C2 通道）
    ↓
defoff.bat（禁用安全软件）
    ↓
Mimikatz / SAM 转储（凭证窃取）
    ↓
SSL VPN / 虚拟桌面（横向移动）
    ↓
端口扫描定位备份系统（TCP/9392 Veeam）
    ↓
WinRAR 压缩 → Mega.nz 外传
    ↓
AES-256-CBC 加密 → .8base 扩展名
    ↓
删除卷影副本 + 禁用恢复

title: 8Base - defoff.bat Windows Defender Disabling
id: 8b001-defoff
status: experimental
description: 检测 8Base 使用 defoff.bat 禁用 Windows Defender
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - 'defoff.bat'
      - 'netsh advfirewall set currentprofile state off'
  condition: selection
level: critical
tags:
  - attack.defense_evasion
  - attack.t1562.001

title: 8Base - Veeam Backup Port Scanning
id: 8b002-veeam-scan
status: experimental
description: 检测对 Veeam 备份端口（TCP/9392）的扫描行为
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 9392
    Initiated: 'true'
  condition: selection
level: high
tags:
  - attack.discovery
  - attack.t1046

title: 8Base - Volume Shadow Copy Deletion
id: 8b003-vss-deletion
status: experimental
description: 检测 8Base 删除卷影副本的行为
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - 'vssadmin'
      - 'delete'
      - 'shadows'
  condition: selection
level: high
tags:
  - attack.defense_evasion
  - attack.t1490

rule 8Base_Ransomware {
    meta:
        description = "检测 8Base 勒索软件载荷"
        author = "Threat Intelligence Team"
        date = "2026-07-01"
        reference = "Phobos Affiliate 2803"
    strings:
        $s1 = ".8base" ascii
        $s2 = "8Base" ascii
        $s3 = "defoff.bat" ascii
        $s4 = "vssadmin delete shadows" ascii
        $s5 = "SmokeLoader" ascii
        $hex1 = { 48 89 5C 24 08 48 89 6C 24 10 48 89 74 24 18 }
    condition:
        3 of ($s*) and $hex1
}