A deep dive into Phobos ransomware, recently deployed by 8Base group
Summary: Cisco Talos detailed how to unpack SmokeLoader's three-stage payload to reach the Phobos ransomware binary used by the 8Base group, which installed AnyDesk for remote access and dumped credentials via LSASS before encrypting files. Talos found Phobos uses AES-256 with a unique random key per file, then encrypts that key with RSA-1024 under a hardcoded public key, and that the same public RSA key appears across over a thousand unpacked Phobos samples on VirusTotal since 2019.
What you should know: Because every Phobos variant since 2019 shares one hardcoded RSA public key, recovery of that single private key would let defenders decrypt files across the entire family - a concentration of risk that cuts both ways for the groups still deploying it.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026