In 2022, HardBit Ransomware emerged as version 4.0. Unlike typical ransomware groups, this ransomware doesn’t use leak sites or double extortion.
Their tactics include data theft, encryption, and ransom requests with threats of other attacks.
Cybersecurity researchers at Cybereason identified that HardBit ransomware has been actively using Passphrase protection to evade security measures.
They talk through TOX which is a peer-to-peer messaging system. Although it is unknown what their initial infection method is, they seem to resemble LockBit Ransomware in some ways.
Their observed TTPs consist of RDP and SMB brute-forcing, credential theft utilizing Mimikatz NLBrute, and possible utilization LaZagne NirSoft tools.
Are you from SOC/DFIR Teams? - Sign up for a free ANY.RUN account! to Analyse Advanced Malware Files
They were known to download programs from picofile[.]com, a Farsi file-sharing site.
The threat actors used network discovery tools such as Advanced Port Scanner and KPortScan 3.0 to move through RDP, reads Cyberreason report.
They installed HardBit ransomware bundled with the Neshta virus, a tool that corrupts files and maintains the infection for a long time.
HardBit ransomware necessitates the input of an authorization ID and encryption key. It also turns off Windows Defender, stops services, and prevents system recovery by using BCDEdit, Vssadmin, WBAdmin, and WMIC in advance of file encryption.
Binary unpacking is part of the complex ransomware process that includes file infection as well as manipulation of systems to ensure successful execution and prevent recovery.
HardBit ransomware selectively encrypts files, updates infected machines, and uses encrypted email contacts. It’s obfuscated with Ryan-_-Borland_Protector Cracked v1.0, a modified ConfuserEx.
The GUI version offers ransom and wiper modes, with wiper mode requiring additional authorization. Configuration file hard.txt can enable wiper mode.
HardBit has evolved through versions 2.0, 3.0, and 4.0, with increasing sophistication in functionality and obfuscation techniques.
Here below we have mentioned all the recommendations:-
“Is Your System Under Attack? Try Cynet XDR: Automated Detection & Response for Endpoints, Networks, & Users!”- Free Demo
Large Language Models (LLMs) are transforming penetration testing (pen testing), leveraging their advanced reasoning and…
Semantic communication systems, powered by Generative AI (GAI), are transforming the way information is transmitted…
A recent wave of cyberattacks has revealed the exploitation of Microsoft Internet Information Services (IIS)…
Cybercriminals are increasingly exploiting image and video files to deliver malware, leveraging advanced techniques like…
A new wave of scareware attacks has emerged, targeting unsuspecting mobile users with fake antivirus…
The National Security Agency (NSA) has officially released Ghidra 11.3, the latest iteration of its…