Researchers have observed samples of “HardBit 2.0” circulating throughout 2023 thus far and noted an interesting tactic identified in the latest campaign. HardBit, first discovered in October 2022, introduced version 2.0 in November 2022 and focuses on exfiltrating sensitive data upon gaining initial access to victims’ networks and encrypting all data. The ransomware attempts to evade analysis by gathering data about the victim machine through web-enterprise management and Windows Management Instrumentation (WMI) functions. It then performs various techniques to lower the machine’s security, such as deleting the Volume Shadow Copy Service (VSS) and the Windows backup utility, editing the boot configuration, disabling Windows Defender Antivirus features, and terminating services. Data is then encrypted and the ransom note is dropped. At this time, the operators behind the ransomware have not created a leak site to publish the stolen data and double extortion does not appear to be in their playbook. In the dropped ransom note, HardBit urges victims to contact them through the Tox instant messaging platform or by email within forty-eight (48) hours of discovery. The threat actors also explain that they seek to negotiate with victims to reach a settlement rather than specifying a bitcoin amount within the ransom note. Victims with cyber insurance policies are urged to privately share their policy details during the negotiations in order to ensure HardBit’s demands fall within their policies. The ransomware operators voice this tactic as benefiting both HardBit and the victim as opposed to the “poor multimillionaire insurers.” If the ransom is not paid, HardBit often threatens additional attacks against the organization. CTIX recommends that victims of HardBit 2.0 engage an incident response firm to facilitate remediation and investigation of the incident. Indicators of compromise (IOCs) can be viewed in the report linked below.