Skyroot Aerospace listed on 8base ransomware leak site

• Ransomware group: 8base
• Country: India
• Sector: Technology
• Announcement date: August 26, 2023

The 8base ransomware group has officially listed Skyroot Aerospace on its leak site, claiming that the Indian technology firm has been compromised. This announcement, made on August 26, 2023, marks a significant escalation in the threat actor's campaign against the organization. The group's public listing serves as a method of pressure, following claims that communication with the target had been initiated but subsequently ceased.

The details of the claim

According to the announcement published by the threat actor, 8base claims to have successfully exfiltrated data belonging to Skyroot Aerospace. The group alleges that a dialogue was initiated between the attackers and the company; however, the group asserts that the company has since ceased all communication. This breakdown in communication often precedes the public release of stolen information on ransomware leak sites.

The threat actor has utilized threatening language in their announcement, warning of the potential publication or leaking of the company's sensitive data if their demands are not met. This tactic is a hallmark of modern ransomware operations, where the threat of exposure is used as leverage. Ransomware leak sites function as public bulletin boards where cybercriminals post information about their victims to shame them into paying ransoms. This method is particularly effective at causing reputational damage and operational pressure.

Data allegedly exfiltrated

The announcement made by 8base claims that a wide variety of sensitive documents have been stolen from the organization. These files reportedly include both corporate-level documentation and sensitive personal information. The specific types of data mentioned in the claim include:

• Invoices
• Receipts
• Accounting documents
• Personal data
• Certificates
• Employment contracts

The inclusion of employment contracts and personal data suggests that the breach extends beyond mere business operations and into the private lives of the organization's workforce. Such a breach can lead to significant secondary risks, including identity theft or highly targeted phishing attacks aimed at the individuals whose information was compromised.

About Skyroot Aerospace

Skyroot Aerospace is an Indian private aerospace company that specializes in the development of rocket technologies for space transportation. The company is focused on designing launch vehicles with the specific goal of making access to space more affordable, reliable, and regular. As a player in the high-tech aerospace sector, the organization handles specialized technical and administrative data essential to its mission of advancing space accessibility.

Analysis and industry implications

The 8base group is recognized as a double-extortion actor. In a double-extortion scheme, attackers do not just encrypt a victim's files to disrupt operations; they also steal sensitive data to threaten its public release. This group is known to typically utilize Phobos-variant encryptors to carry out their attacks. This dual approach ensures that even if an organization can restore its systems from backups, they still face the risk of data exposure and the subsequent legal and reputational fallout.

For an organization in the technology and aerospace sector, such an incident presents multifaceted risks. Beyond the immediate operational disruptions caused by the encryption of systems, the potential leakage of sensitive corporate and personal data can trigger complex legal processes. Given that Skyroot Aerospace is based in India, the breach may trigger legal proceedings under relevant local data protection regulations. The exposure of employment contracts and personal identifiers significantly increases the risk profile for employees, who may become targets for further social engineering or identity fraud.

The persistence of such groups is a notable concern for the cybersecurity community. It has been observed that 8base may continue its activities despite various operational interventions reported in early 2025. This resilience highlights the ongoing challenge faced by organizations to defend against sophisticated ransomware groups. To mitigate such risks, organizations in high-stakes sectors typically focus on robust data protection, strict access controls, and comprehensive monitoring to detect exfiltration attempts before they escalate into full-scale breaches.