Threat Intelligence Tarot
Vol. II · 138
Criminal
★★★★★
risk 3/5
✦ The Loud Shame ✦
8Base
Phobos affiliate · Smokeloader-distributed
Small and medium businessesBrazilUnited StatesUnited KingdomDiverse sectors
Active since ~2022 · Extortion, Financial gain
The Loud Shame does not negotiate with elegance. It posts, it bullies, it rushes. The strategy is volume — many small victims, many small ransoms, the sum greater than discretion would have allowed.
Tactics & Techniques
RCN
RDV
INI
EXC
PRS
PRV
EVA
CRD
DSC
LAT
COL
C2
EXF
IMP
T1486
Data Encrypted for Impact
Impact
T1078
Valid Accounts
Persistence
T1190
Exploit Public-Facing Application
Initial Access
T1567.002
Exfiltration to Cloud Storage
Exfiltration
T1490
Inhibit System Recovery
Impact
T1027
Obfuscated Files or Information
Defense Evasion
Notable Operations
  • ◆SmokeLoader-delivered Phobos ransomware variants
  • ◆Rapid victim disclosure cadence beginning mid-2023
  • ◆SME targeting across US, Brazil, and the UK
  • ◆Operator arrests in Thailand (February 2025)
Defenses
Reversed: Their Weakness
Law enforcement disruption of Phobos infrastructure and SmokeLoader takedowns directly impair this operator. SME-focused MSSPs that share IOCs widely turn each victim into protection for the next.

Share this adversary profile

Compare →

swipe to browse

← PreviousThe InheritorNext →The Self-Encrypting Thorn
Related Adversaries
The Incorporated Hunger
INC Ransom
6 shared TTPs
★★★★★
The National Brownout
Brain Cipher
5 shared TTPs
★★★★★
The Self-Encrypting Thorn
Cactus
5 shared TTPs
★★★★★
Data sourced from MITRE ATT&CK. For educational purposes.