A ransomware group is asking victims who have insurance for details of their policies, claiming that they can ultimately reduce their risk.
HardBit 2.0, which was introduced in November 2022, claims to steal data from victim organizations before encrypting them, but Varonis said unusually for such groups, the leaked site and does not use “double extortion” as a tactic.
Instead, the group appears to threaten further attacks if their demands are not met.
“Instead of specifying the amount of Bitcoin demanded in this ransom note, the group is trying to negotiate a settlement with the victims,” Varonis explained in a blog post.
“In particular, as part of these negotiations, victims with cyber insurance policies are also encouraged to share their details with HardBit so that they can tailor their claims to stay within the policy.”
In this part of the ransom note, the group attempts to portray victims’ insurance companies as enemies, claiming that they will always try to negotiate a price cut, even if the policy stipulates much higher coverage. We speculate that this approach may allow the group to leak stolen data or refuse to provide decryption keys.
“The unscrupulous insurance agent will deliberately negotiate not to pay the insurance, so only the insurance company wins in this situation,” the ransom note reads.
“To avoid all of this and receive your insurance benefits, please anonymously inform us of your insurance coverage and terms. It benefits both you and us, but not the insurance company.” Poor billionaire insurance companies will not starve…”
HardBit victims should be aware that most policies specifically prohibit sharing this type of information with ransomware actors.
The malware itself appears to be fairly standard, exposing the victim’s network by performing various pre-encryption steps such as deleting the Windows Backup utility catalog and Volume Shadow Copy Service (VSS). It also disables various Windows Defender features and terminates numerous services related to data backup/recovery tools and endpoint security solutions, Varonis said.
