Loading threat actor…
HardBit is a ransomware operation active since 2022 that focuses primarily on encryption-based extortion rather than public leak-site pressure. The group’s malware has evolved through multiple versions, with HardBit 4.0 introducing stronger obfuscation, multi-stage deployment, and aggressive defense evasion. A notable characteristic of recent variants is use of the Neshta file infector as a dropper and persistence mechanism, enabling the ransomware payload to be extracted and launched while complicating detection and analysis. HardBit has also been distributed in both command-line and graphical formats, indicating operational flexibility for different operator skill levels. HardBit commonly gains initial access through brute-force activity against exposed remote services, particularly RDP and SMB. Post-compromise activity includes credential theft, network reconnaissance, and lateral movement, with operators using harvested credentials to expand access across the environment. The malware disables or weakens Windows Defender protections, stops security and backup-related services, removes recovery options, and employs runtime passphrase or authorization requirements intended to hinder sandboxing and automated analysis. Some HardBit 4.0 deployments also include a wiper capability that can permanently destroy data instead of, or in addition to, encryption. Known behavior associated with HardBit includes persistence, brute-force intrusion, credential theft, reconnaissance, lateral movement, defense evasion, and post-exploitation actions designed to maximize impact on enterprise networks. Publicly available reporting does not support operation of a leak site or routine double-extortion activity for this actor, and current evidence indicates HardBit is primarily motivated by financial gain.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
HardBit is known for conducting ransomware attacks against organizations, focusing on encryption-based ransom demands without using public data leak sites for double extortion. The group has recently upgraded to HardBit 4.0, which features advanced evasion and persistence techniques.
HardBit is known for conducting ransomware attacks, focusing on encrypting or destroying data (via a wiper mode) without operating a data leak site for double extortion. The group employs advanced obfuscation, defense evasion, and lateral movement techniques, and has evolved its malware to require runtime authorization keys to hinder analysis.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.