This new ransomware strain wants to get your insurance details so it can negotiate a bigger price

Date:
Tue, 21 Feb 2023 14:02:03 +0000

Description:
Crooks are trying to pit victims against their insurance firms in the hope of getting a bigger payout.

FULL STORY ======================================================================

Operators of a new ransomware strain have been seen trying to encourage victims to pay the ransom demand by pitting them against their insurance companies.

The HardBit 2.0 variant has been seen carrying a few novel tricks up its sleeve, including a modified ransom note in which the attackers say that if their ransom demand is within the range covered by the insurance company,
then that company is obliged to cover the costs of the cyberattack.

But the problem is, the crooks never know what the insurance details are, and the victims are contractually obliged to keep that information secret. Still, the crooks try to talk the victim into sharing that information, albeit privately. Voiding the insurance contract

"To avoid all this and get the money on the insurance, be sure to inform us anonymously about the availability and terms of the insurance coverage, it benefits both you and us, but it does not benefit the insurance company," the note says.

The note essentially shows insurance companies as the bad guys, and further tells the victims not to engage with intermediaries or third parties, as that would only drive up the costs.

Besides suggesting action that would void the insurance contract, the crooks made other changes to the ransomware strain, as well. Now, the malware is
able to modify the endpoints Registry and disable Windows Defender real-time behavioral monitoring, process scanning, and on-access file protections, BleepingComputer reported. Furthermore, it tries to kill 86 processes to better encrypt sensitive files. Read more

What is ransomware and how does it work?

This new ransomware is seeing rapid growth, so beware

These are the best firewalls right now

Lastly, it doesnt write encrypted data to file copies and then delete the originals, but rather opens the files and overwrites the content with encrypted data. That, allegedly, makes the encryption process faster, and recovery more difficult.

Disclosing insurance detail is something no one can recommend. Instead, businesses would be better off educating their employees on the dangers of phishing and social engineering, installing a strong firewall and cybersecurity solution, and keeping their backups fresh. Here's our list of the best endpoint protection solutions right now

Via: BleepingComputer



======================================================================
Link to news story: https://www.techradar.com/news/this-new-ransomware-strain-wants-to-get-your-in surance-details-so-it-can-negotiate-a-bigger-price


--- Mystic BBS v1.12 A47 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)