Ankura CTIX FLASH Update - February 21, 2023

Malware Activity

HardBit 2.0 Ransomware Urges Victims for Cyber Insurance Policy Details Prior to Establishing Ransom Amount

Researchers have observed samples of "HardBit 2.0" circulating throughout 2023 thus far and noted an interesting tactic identified in the latest campaign. HardBit, first discovered in October 2022, introduced version 2.0 in November 2022 and focuses on exfiltrating sensitive data upon gaining initial access to victims' networks and encrypting all data. The ransomware attempts to evade analysis by gathering data about the victim machine through web-enterprise management and Windows Management Instrumentation (WMI) functions. It then performs various techniques to lower the machine's security, such as deleting the Volume Shadow Copy Service (VSS) and the Windows backup utility, editing the boot configuration, disabling Windows Defender Antivirus features, and terminating services. Data is then encrypted and the ransom note is dropped. At this