Overview

• The NPA launched the decryption software on July 17, offering global access through its website and Europol’s No More Ransom portal.
• Victims can restore files encrypted by Phobos and 8Base with a single “decrypt” click, requiring no specialized expertise.
• The Cyber Special Investigation Unit developed the tool by analyzing virus design information from dark-web sites together with data seized by the FBI.
• Since 2018, Phobos and 8Base ransomware have caused about 2,000 incidents across 22 countries, including roughly 90 cases in Japan affecting hospitals and service companies.
• This release is the NPA’s second publicly available recovery tool following its February 2024 solution for LockBit strains, underscoring growing law enforcement efforts against cyberextortion.