New HardBit Ransomware 4.0 Incorporates Passphrase Protection to Avoid Detection
Cybersecurity experts have revealed a fresh iteration of a ransomware type known as HardBit, which incorporates innovative obfuscation methods to deter analysis endeavors.
“In contrast to prior versions, the HardBit Ransomware group has upgraded version 4.0 with passphrase protection,” noted analysts Kotaro Ogino and Koshi Oyama from Cybereason in their assessment.
“For the ransomware to operate effectively, the user must furnish the passphrase during execution. Increased obfuscation makes it challenging for security analysts to dissect the malicious software.”
HardBit, which made its initial appearance in October 2022, is a financially incentivized threat group that, akin to other ransomware cohorts, operates with the objective of generating illegal profits through double extortion strategies.
One notable aspect of this threat group is its absence of a data leakage platform; instead, it coerces victims to make payments by threatening further attacks in the future. Communication primarily takes place via the Tox instant messaging service.
The specific method used to breach targeted networks initially remains ambiguous, although brute force attacks on RDP and SMB services are suspected.
The subsequent actions involve executing credential theft using tools like Mimikatz and NLBrute, and carrying out network reconnaissance using utilities such as Advanced Port Scanner, thus allowing the attackers to move laterally across the network through RDP.
“Once a victim’s host is compromised, the payload of the HardBit ransomware is activated and executes multiple actions to weaken the host’s security before encrypting the victim’s data,” as highlighted by Varonis in its technical exposition of HardBit 2.0 last year.
The encryption of victim systems is facilitated by deploying HardBit, which is disseminated using a well-known file infector virus referred to as Neshta. It’s important to note that Neshta has been utilized by threat actors previously to also disseminate Big Head ransomware.
HardBit is also engineered to deactivate Microsoft Defender Antivirus, terminate processes and services to evade potential detection of its actions, and hinder system recovery. Subsequently, it encrypts desired files, updates their icons, alters the desktop wallpaper, and modifies the system’s volume label to read “Locked by HardBit.”
Other than being offered to operators in either command-line or GUI forms, the ransomware necessitates an authorization ID for successful execution. The GUI variant also supports a wiper mode for irreversibly erasing files and wiping the disk.
“Upon successful input of the decoded authorization ID by threat actors, HardBit prompts for an encryption key to encrypt the files on the target devices, thereby commencing the ransomware process,” as observed by Cybereason.
“The wiper mode function must be enabled by the HardBit Ransomware group; this feature is likely an optional addition that operators can procure. Those seeking wiper mode capability would need to deploy hard.txt, an elected configuration file of the HardBit binary that includes the authorization ID to enable this mode.”
This occurrence coincides with cybersecurity outfit Trellix’s explanation of a CACTUS ransomware assault exploiting vulnerabilities in Ivanti Sentry (CVE-2023-38035) to deliver the file-encrypting malware using legitimate remote desktop applications such as AnyDesk and Splashtop.
Ransomware incidents continue to show an “upward trajectory” in 2024, with ransomware actors claiming 962 attacks in Q1 2024, an increase from the 886 attacks reported year-on-year. Noteworthy ransomware families during this period include LockBit, Akira, and BlackSuit as per Symantec.
According to Palo Alto Networks’ 2024 Unit 42 Incident Response report, the time taken for compromise to data exfiltration has reduced from nine days in 2021 to two days in the previous year, with just under 24 hours noted in 45% of cases this year.
“Current indications suggest that exploiting known vulnerabilities in publicly accessible applications continues to be a primary channel for ransomware attacks,” stated the Broadcom-owned company. “Bring Your Own Vulnerable Driver (BYOVD) remains a favored tactic among ransomware groups, particularly for disabling security solutions.”
About Author
