CryptBB is a likely Russian-origin ransomware group that appends random extensions to files and mimics 8Base's source code.
CryptBB is a ransomware group with likely Russian origins. They target corporate victims and apply pressure through a data leak site. During encryption, they append random extensions to files, and their leak site was built by copying the source code of the 8Base group. Defenders should be alert to unusual file extension changes, verify backups, and strengthen security monitoring for indicators linked to 8Base's TTPs.
CryptBB is a ransomware group with likely Russian origins active around 2023, whose payload appends random extensions to encrypted files and whose data leak site copied 8Base's source code, listing approximately 8 victims as of September 2023.
The CryptBB ransomware appends random file extensions to files after encryption.
CryptBB's data leak site was built by copying the source code of the 8Base group.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.