Thai authorities detain four Europeans in ransomware crackdown | CyberScoop<\/title> <meta name=\"description\" content=\"A multi-national law enforcement operation targeted the 8base ransomware gang, with Thai police arrested two men and two women.\"> <link rel=\"canonical\" href=\"https:\/\/cyberscoop.com\/8base-ransomware-arrests-thailand-domain-seizure\/\"> <meta property=\"og:locale\" content=\"en_US\"> <meta property=\"og:type\" content=\"article\"> <meta property=\"og:title\" content=\"Thai authorities detain four Europeans in ransomware crackdown\"> <meta property=\"og:description\" content=\"A multi-national law enforcement operation targeted the 8base ransomware gang, with Thai police arrested two men and two women.\"> <meta property=\"og:url\" content=\"https:\/\/cyberscoop.com\/8base-ransomware-arrests-thailand-domain-seizure\/\"> <meta property=\"og:site_name\" content=\"CyberScoop\"> <meta property=\"article:published_time\" content=\"2025-02-10T20:32:47+00:00\"> <meta property=\"article:modified_time\" content=\"2025-02-10T20:32:50+00:00\"> <meta property=\"og:image\" content=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/thai-authorities-detain-four-europeans-in-ransomware-crackdown-1.png\"> <meta property=\"og:image:width\" content=\"1569\"> <meta property=\"og:image:height\" content=\"719\"> <meta property=\"og:image:type\" content=\"image\/png\"> <meta name=\"author\" content=\"Greg Otto\"> <meta name=\"twitter:card\" content=\"summary_large_image\"> <meta name=\"twitter:creator\" content=\"@gregotto\">  <link rel=\"dns-prefetch\" href=\"\/\/securepubads.g.doubleclick.net\">\n<link rel=\"dns-prefetch\" href=\"\/\/use.typekit.net\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Feed\" href=\"https:\/\/cyberscoop.com\/feed\/\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Comments Feed\" href=\"https:\/\/cyberscoop.com\/comments\/feed\/\"> <link rel=\"stylesheet\" id=\"all-css-2\" href=\"https:\/\/cyberscoop.com\/wp-includes\/css\/dist\/block-library\/style.min.css?m=1732206022g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-6\" href=\"https:\/\/cyberscoop.com\/wp-content\/mu-plugins\/search\/elasticpress\/dist\/css\/related-posts-block-styles.min.css?m=1736472017g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-8\" href=\"https:\/\/cyberscoop.com\/wp-content\/themes\/scoopnewsgroup\/dist\/css\/frontend.css?m=1738946988g\" type=\"text\/css\" media=\"all\">\n<link rel=\"stylesheet\" id=\"typekit-css\" href=\"https:\/\/use.typekit.net\/itk2qbh.css?ver=811a4fffdf449a472805\" media=\"all\"> <link rel=\"https:\/\/api.w.org\/\" href=\"https:\/\/cyberscoop.com\/wp-json\/\"><link rel=\"alternate\" title=\"JSON\" type=\"application\/json\" href=\"https:\/\/cyberscoop.com\/wp-json\/wp\/v2\/posts\/83455\"><link rel=\"EditURI\" type=\"application\/rsd+xml\" title=\"RSD\" href=\"https:\/\/cyberscoop.com\/xmlrpc.php?rsd\">\n<meta name=\"generator\" content=\"WordPress 6.7.1\">\n<link rel=\"shortlink\" href=\"https:\/\/cyberscoop.com\/?p=83455\">\n<link rel=\"alternate\" title=\"oEmbed (JSON)\" type=\"application\/json+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2F8base-ransomware-arrests-thailand-domain-seizure%2F\">\n<link rel=\"alternate\" title=\"oEmbed (XML)\" type=\"text\/xml+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2F8base-ransomware-arrests-thailand-domain-seizure%2F&format=xml\">   <link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=32\" sizes=\"32x32\">\n<link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=192\" sizes=\"192x192\">\n<link rel=\"apple-touch-icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=180\">\n<meta name=\"msapplication-TileImage\" content=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=270\"> <\/head><body class=\"post-template-default single single-post postid-83455 single-format-standard\" id=\"readabilityBody\"> <a href=\"https:\/\/cyberscoop.com\/8base-ransomware-arrests-thailand-domain-seizure\/#main\" class=\"skip-to-content-link visually-hidden-focusable\">Skip to main content<\/a> <\/p>\n<div class=\"ad ad--top ad--top-desktop\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p> <main id=\"main\" role=\"main\" tabindex=\"-1\"> <\/p>\n<div class=\"ad ad--top ad--top-mobile\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<section id=\"stickybar\" class=\"stickybar stickybar--event js-stickybar\">\n<div class=\"stickybar__details\" readability=\"5.12\">\n<div class=\"stickybar__info js-sticky-bar-content\" readability=\"32\">\n<p>Nominations can be submitted for the 2025 CyberScoop 50 awards!<\/p>\n<\/div>\n<p> <a class=\"stickybar__link button button-tertiary\" href=\"https:\/\/cyberscoop.com\/cyberscoop50\/\">Click here!<\/a> <\/div>\n<p> <button class=\"stickybar__close js-stickybar-close\" aria-controls=\"stickybar\"> <svg class=\"icon icon--close\" width=\"21\" height=\"22\" viewBox=\"0 0 21 22\" fill=\"none\"><path d=\"m.822.518-.805.805L9.695 11 .017 20.678l.805.805 9.678-9.678 9.677 9.678.806-.805L11.305 11l9.678-9.677-.806-.805-9.677 9.677L.822.518Z\" fill=\"currentColor\" \/><\/svg> <span class=\"visually-hidden\">Close<\/span> <\/button> <\/section>\n<article class=\"single-article content\">\n<div class=\"single-article__container js-single-article-content\">\n<header class=\"single-article__header \" readability=\"24.672043010753\">\n<div class=\"single-article__header-content\" readability=\"33.038348082596\">\n<ul class=\"single-article__eyebrow\">\n<li class=\"single-article__category\"> <a class=\"single-article__category-link\" href=\"https:\/\/cyberscoop.com\/8base-ransomware-arrests-thailand-domain-seizure\/\"> <span>Ransomware<\/span> <\/a> <\/li>\n<\/ul>\n<p> The multi-national law enforcement operation targeted the 8base ransomware gang. <\/p>\n<p>  <br \/>\n<audio id=\"audio-player\" src=\"https:\/\/wp-tts-cdn.api.scpnewsgrp.com\/cyberscoop\/83455\/english.openai.mp3\"><\/audio> <\/p>\n<div readability=\"11\">\n<div>\n<p>Listen to this article<\/p>\n<p>  <\/p>\n<p>0:00<\/p>\n<\/p><\/div>\n<p>  <\/p>\n<p> <span id=\"tts-tooltip\">Learn more.<\/span> <span> This feature uses an automated voice, which may result in occasional errors in pronunciation, tone, or sentiment. <\/span> <\/p>\n<\/div>\n<p>  <\/div>\n<div class=\"single-article__cover-wrap\">\n<figure class=\"single-article__cover\"> <img data-recalc-dims=\"1\" fetchpriority=\"high\" width=\"640\" height=\"293\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/thai-authorities-detain-four-europeans-in-ransomware-crackdown.png?resize=640%2C293&ssl=1\" class=\"single-article__cover-image wp-post-image\" alt decoding=\"async\" fetchpriority=\"high\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/thai-authorities-detain-four-europeans-in-ransomware-crackdown-1.png 1569w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/thai-authorities-detain-four-europeans-in-ransomware-crackdown-1.png?resize=300,137 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/thai-authorities-detain-four-europeans-in-ransomware-crackdown-1.png?resize=768,352 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/thai-authorities-detain-four-europeans-in-ransomware-crackdown-1.png?resize=1024,469 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/thai-authorities-detain-four-europeans-in-ransomware-crackdown-1.png?resize=1536,704 1536w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/thai-authorities-detain-four-europeans-in-ransomware-crackdown-1.png?resize=600,275 600w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/thai-authorities-detain-four-europeans-in-ransomware-crackdown-1.png?resize=1200,550 1200w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/thai-authorities-detain-four-europeans-in-ransomware-crackdown-1.png?resize=1500,687 1500w\" sizes=\"(max-width: 1200px) 100vw, 1200px\"><figcaption> (Screenshot by Scoop News Group) <\/figcaption><\/figure>\n<\/p><\/div>\n<\/header>\n<div class=\"single-article__content\">\n<div class=\"single-article__content-inner has-drop-cap\"> <html readability=\"30.131926121372\"><body readability=\"61.331152902698\"><\/p>\n<p>In a sweeping international law enforcement operation, Thai authorities arrested four Europeans in Phuket, accusing them of orchestrating ransomware attacks affecting Swiss companies worldwide. The suspects are allegedly tied to the 8Base ransomware-as-a-service (RaaS) gang, which extorted $16 million worth of Bitcoin from over 1,000 individuals.<\/p>\n<p>The operation, termed \u201cPhobos Aetor,\u201d reflected a tightly coordinated effort among law enforcement agencies from Europe, Asia, and North America. Authorities arrested two men and two women, <a href=\"https:\/\/www.nationthailand.com\/news\/general\/40046122\">according to Thai media<\/a>, and seized the digital infrastructure \u2014 laptops, smartphones, and digital wallets \u2014 that supported their activities.<\/p>\n<p>Ransomware has emerged as a formidable threat in cybercrime, enabling perpetrators to breach digital networks, encrypt critical data, and demand payments for decryption keys. The 8Base group, active since March 2022, is notorious for its dual extortion tactics \u2014 encrypting data and threatening to leak sensitive information unless a ransom was paid.<\/p>\n<p>The detainees, whose identities remain undisclosed, were allegedly involved in compromising the networks of 17 companies in Switzerland between April 2023 and October 2024.<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>Additionally, the data leak site domain used by the 8Base group had a seizure notice posted Monday, bearing the insignia of several law enforcement agencies, including the FBI and the DoD Cyber Crime Center. <\/p>\n<p>In the cybercrime underground, 8Base positioned itself as a data-extortion operation rather than a traditional ransomware entity, gaining notoriety due to the vast number of victims displayed on their data leak site. The group was extremely active in 2023 to the point that the group combined with two other notorious RaaS gangs \u2014 Cl0p and LockBit \u2014 to account for 48% of all cyberattacks recorded <a href=\"https:\/\/www.hhs.gov\/sites\/default\/files\/8base-ransomware-analyst-note.pdf\">in July of that year<\/a>. <\/p>\n<p>Takedowns of cybercriminal infrastructure have increased, with a FBI official saying last year the bureau helped <a href=\"https:\/\/cyberscoop.com\/fbi-ransomware-disruption-infrastructure-cybertalks\/\">orchestrate 30 operations<\/a> in which infrastructure was seized. In February 2024, <a href=\"https:\/\/www.nationalcrimeagency.gov.uk\/news\/nca-leads-international-investigation-targeting-worlds-most-harmful-ransomware-group\">a coordinated operation<\/a> led by the U.K.\u2019s National Crime Agency in cooperation with the FBI and the U.S. Justice Department disrupted LockBit\u2019s infrastructure, seizing websites and servers critical to its operations.<\/p>\n<p>The DOJ revealed charges <a href=\"https:\/\/cyberscoop.com\/lockbit-ransomware-developer-rostislav-panev-charges\/\">in December<\/a> against Rostislav Panev, a dual Russian and Israeli national, for his alleged role as a developer in the LockBit ransomware group.<\/p>\n<p><\/body> <\/p>\n<footer class=\"single-article__footer\" readability=\"3.9230769230769\">\n<div class=\"author-card\" readability=\"14\">\n<div class=\"author-card__avatar\">\n<figure class=\"author-card__image-wrap\"> <img data-recalc-dims=\"1\" decoding=\"async\" class=\"author-card__image\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/02\/thai-authorities-detain-four-europeans-in-ransomware-crackdown.jpg?w=640&ssl=1\" alt=\"Greg Otto\"> <\/figure>\n<\/p><\/div>\n<p><h4 class=\"author-card__name\">Written by Greg Otto<\/h4>\n<p> Greg Otto is Editor-in-Chief of CyberScoop, overseeing all editorial content for the website. Greg has led cybersecurity coverage that has won various awards, including accolades from the Society of Professional Journalists and the American Society of Business Publication Editors. Prior to joining Scoop News Group, Greg worked for the Washington Business Journal, U.S. News & World Report and WTOP Radio. He has a degree in broadcast journalism from Temple University. <\/p>\n<\/p><\/div>\n<div class=\"single-article__tags-container\">\n<h4 class=\"single-article__tags-title\">In This Story<\/h4>\n<\/p><\/div>\n<\/footer>\n<p> <\/html><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"single-article__ads js-single-article-sidebar\">\n<div class=\"ad ad--sidebar js-single-article-sidebar-5 ad--rightrail_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-4 ad--rightrail_2 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-3 ad--rightrail_3 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div><\/div>\n<\/article>\n<div class=\"popular-stories popular-stories--single-post\">\n<div class=\"popular-stories__container\">\n<h2 class=\"popular-stories__title\"> More Scoops <\/h2>\n<p>  <\/div>\n<p>\n<\/div>\n<p> <\/p>\n<section class=\"latest-podcasts\">\n<h2 class=\"latest-podcasts__title\"> Latest Podcasts\t<\/h2>\n<\/section>\n<div class=\"top-categories\">\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Government<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Technology<\/h3>\n<\/p><\/div>\n<\/p><\/div>\n<p> <\/main> <\/p>\n<div class=\"ad ad--bottom \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div id=\"interstitial\" class=\"welcome__container\"> <button id=\"close-modal-1\" class=\"welcome__clickable_area\"><\/button> <\/p>\n<div class=\"welcome__ad_wrapper\">\n<p> <button id=\"close-modal-3\" class=\"welcome__continue-button\">Continue to CyberScoop<\/button> <\/p>\n<\/p><\/div>\n<\/p><\/div>\n<p>   <\/body> <a href=\"https:\/\/cyberscoop.com\/8base-ransomware-arrests-thailand-domain-seizure\/\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Thai authorities detain four Europeans in ransomware crackdown | CyberScoop<\/p>\n","protected":false},"author":11,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[1899,322,282,78,3691,669,462,46,288],"tags":[1900,326,286,86,3692,671,463,54,294],"class_list":["post-7265","post","type-post","status-publish","format-standard","hentry","category-8base","category-clop","category-cybercrime","category-cybersecurity","category-dod-cyber-crime-center","category-federal-bureau-of-investigation-fbi","category-lockbit","category-ransomware","category-threats","tag-8base","tag-clop","tag-cybercrime","tag-cybersecurity","tag-dod-cyber-crime-center","tag-federal-bureau-of-investigation-fbi","tag-lockbit","tag-ransomware","tag-threats"],"featured_image_urls":{"full":"","thumbnail":"","medium":"","medium_large":"","large":"","1536x1536":"","2048x2048":"","chromenews-featured":"","chromenews-large":"","chromenews-medium":""},"author_info":{"display_name":"Cyber Scoop","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/cyberscoop\/"},"category_info":"<a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/8base\/\" rel=\"category tag\">8Base<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/clop\/\" rel=\"category tag\">Clop<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/cybercrime\/\" rel=\"category tag\">cybercrime<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/cybersecurity\/\" rel=\"category tag\">Cybersecurity<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/dod-cyber-crime-center\/\" rel=\"category tag\">DoD Cyber Crime Center<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/federal-bureau-of-investigation-fbi\/\" rel=\"category tag\">Federal Bureau of Investigation (FBI)<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/lockbit\/\" rel=\"category tag\">LockBit<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/ransomware\/\" rel=\"category tag\">ransomware<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/threats\/\" rel=\"category tag\">Threats<\/a>","tag_info":"Threats","comment_count":"0","jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/7265","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=7265"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/7265\/revisions"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=7265"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=7265"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=7265"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":7265,"date":"2025-02-10T14:32:47","date_gmt":"2025-02-10T20:32:47","guid":{"rendered":"https:\/\/cyberscoop.com\/?p=83455"},"modified":"2025-02-10T14:32:47","modified_gmt":"2025-02-10T20:32:47","slug":"thai-authorities-detain-four-europeans-in-ransomware-crackdown","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2025\/02\/10\/thai-authorities-detain-four-europeans-in-ransomware-crackdown\/","title":{"rendered":"Thai authorities detain four Europeans in ransomware crackdown"},"content":{"rendered":"