Hardbit

HardBit is a malicious software (malware) that first emerged in the threat landscape in October 2022. This ransomware is particularly harmful as it can disable Microsoft Defender Antivirus and inhibit System Recovery, making it difficult for victims to restore their systems post-infection. The malware is typically deployed using the file infector Neshta for encryption purposes. HardBit shares numerous similarities with another well-known ransomware called LockBit, including group name, image/icons, fonts, and ransom notes. However, any direct link between these two remains speculative, possibly being part of HardBit's marketing tactics. The HardBit ransomware has been observed to be transferred through email as a ZIP attachment or over HTTP/S, which are common infiltration and lateral movement methods used by many cybercriminals. Once inside a network, the HardBit group instructs victims to contact them via email or the Tox instant messaging platform. Interestingly, unlike many other ransomware operations, HardBit does not employ a double extortion model at this time. The group offers its malware in both Command-Line Interface (CLI) and Graphical User Interface (GUI) versions. The HardBit ransomware has evolved since its inception, with its latest version (4.0) featuring Binary Obfuscation Enhancement with passphrase protection. This makes the malware even more potent and challenging to combat. It uses various tactics across different versions such as disabling Windows Defender, inhibiting System Recovery, stopping services, and using a configuration file named hard.txt. Despite extensive research, the initial access method employed by the HardBit Ransomware group remains unknown, but experts suggest it follows methodologies associated with other ransomware operations.