Threat actors from the relatively unknown 8Base ransomware organization have become increasingly active over the past several weeks, ransoming several organizations and leaking data on their public leak forum. The 8Base ransomware group is a year-old “name-and-shame” organization that often threatens its victims with immediate data leakage if their ransom demands are not promptly fulfilled. 8Base threat actors have exploited companies on a global scale primarily focused on the finance, healthcare, hospitality, legal, and information technology industries. When exploiting their targets, 8Base actors will often deploy a variant of the Phobos ransomware and/or SmokeLoader malware downloader delivered primarily through social engineering techniques. While 8Base remains their own threat group, there are some significant similarities between the group and another destructive ransomware group known as RansomHouse. These alignments are seen in several different areas including a near-identical ransomware note on compromised systems alongside identical welcome page messages, Terms of Service statements, and frequently asked questions (FAQ) sections on the public leak forum. While there are some differences that can be observed between the two ransom groups, these factors indicate the medium-high confidence that 8Base is a sub-organization or rebrand of RansomHouse. CTIX continues to monitor threat actor activity worldwide and will provide additional updates accordingly.