Forest Global Training Partners

Cyber Risks · Krebs on Security

Who’s Behind the 8Base Ransomware Website?

Summary: A verbose error page on the 8Base ransomware group's darknet victim-shaming site exposed the server's true IP address (95.216.51[.]74, a Hetzner server in Finland) and a link to a private Gitlab repository, gitlab[.]com/jcube-group/clients/apex/8base-v2. The code in that repository, including a login page nearly identical to the 8Base admin page and a status.php file referencing KYC checks, points to a 36-year-old full-stack developer in Chisinau, Moldova named Andrei Kolev, who said he had no knowledge of the 8Base project and whose repository link disappeared from the site within minutes of KrebsOnSecurity contacting him.

Key Takeaway: The 8Base site was left in development mode, and a single GET request to its chat feature was enough to reveal the hosting IP and the developer's private repository - the same kind of misconfiguration that any routine vulnerability scan would flag, now sitting on the infrastructure of a group VMware/Carbon Black calls a 'heavy hitter' active since March 2022.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related