HardBit Ransomware Using Passphrase Protection To Evade Detection

In 2022, HardBit Ransomware emerged as version 4.0. Unlike typical ransomware groups, this ransomware doesn’t use leak sites or double extortion.

Their tactics include data theft, encryption, and ransom requests with threats of other attacks.

Cybersecurity researchers at Cybereason identified that HardBit ransomware has been actively using Passphrase protection to evade security measures.

HardBit Ransomware & Passphrase Protection

They talk through TOX which is a peer-to-peer messaging system. Although it is unknown what their initial infection method is, they seem to resemble LockBit Ransomware in some ways.

Their observed TTPs consist of RDP and SMB brute-forcing, credential theft utilizing Mimikatz NLBrute, and possible utilization LaZagne NirSoft tools.

Are you from SOC/DFIR Teams? - Sign up for a free ANY.RUN account! to Analyse Advanced Malware Files

They were known to download programs from picofile[.]com, a Farsi file-sharing site.

Open Ports Detected On The Brute Forcing Server (Source – Cybereason)

The threat actors used network discovery tools such as Advanced Port Scanner and KPortScan 3.0 to move through RDP, reads Cyberreason report.

They installed HardBit ransomware bundled with the Neshta virus, a tool that corrupts files and maintains the infection for a long time.

HardBit Packed Neshta Execution Flow (Source – Cybereason)

HardBit ransomware necessitates the input of an authorization ID and encryption key. It also turns off Windows Defender, stops services, and prevents system recovery by using BCDEdit, Vssadmin, WBAdmin, and WMIC in advance of file encryption.

HardBit Ransomware Execution Procedure (Source – Cybereason)

Binary unpacking is part of the complex ransomware process that includes file infection as well as manipulation of systems to ensure successful execution and prevent recovery.

HardBit ransomware selectively encrypts files, updates infected machines, and uses encrypted email contacts. It’s obfuscated with Ryan-_-Borland_Protector Cracked v1.0, a modified ConfuserEx. 

The GUI version offers ransom and wiper modes, with wiper mode requiring additional authorization. Configuration file hard.txt can enable wiper mode. 

HardBit has evolved through versions 2.0, 3.0, and 4.0, with increasing sophistication in functionality and obfuscation techniques.

Recommendations

Here below we have mentioned all the recommendations:-

  • Enable Application Control to block execution of malicious files.
  • Activate Predictive Ransomware Protection.
  • If Predictive Ransomware Protection is unavailable, enable Anti-Ransomware.
  • Enable Variant Payload Prevention on your security solution with Prevent mode.

“Is Your System Under Attack? Try Cynet XDR: Automated Detection & Response for Endpoints, Networks, & Users!”- Free Demo

Tushar Subhra

Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Recent Posts

Autonomous LLMs Reshaping Pen Testing: Real-World AD Breaches and the Future of Cybersecurity

Large Language Models (LLMs) are transforming penetration testing (pen testing), leveraging their advanced reasoning and…

18 hours ago

Securing GAI-Driven Semantic Communications: A Novel Defense Against Backdoor Attacks

Semantic communication systems, powered by Generative AI (GAI), are transforming the way information is transmitted…

18 hours ago

Cybercriminals Target IIS Servers to Spread BadIIS Malware

A recent wave of cyberattacks has revealed the exploitation of Microsoft Internet Information Services (IIS)…

18 hours ago

Hackers Leveraging Image & Video Attachments to Deliver Malware

Cybercriminals are increasingly exploiting image and video files to deliver malware, leveraging advanced techniques like…

21 hours ago

New Scareware Attack Targeting Mobile Users to Deploy Malicious Antivirus Apps

A new wave of scareware attacks has emerged, targeting unsuspecting mobile users with fake antivirus…

21 hours ago

Ghidra 11.3 Released – A Major Update to NSA’s Open-Source Tool

The National Security Agency (NSA) has officially released Ghidra 11.3, the latest iteration of its…

21 hours ago