Hakbit
Aliases: Thanos Ransomware
- First seen
- 2019-06-01 00:00:00
- Malware type
- ransomware
- Family
- Malware family
- Last IoC activity
- 2026-06-17 14:49:49
- Profile updated
- 2026-07-07 12:38:36
Targeted industries: healthcare-and-pharmaceutical financial-services education-and-nonprofits
Targeted regions: country_code:us country_code:de country_code:ca
Context
Hakbit, also known as Thanos Ransomware, is a ransomware family that encrypts files on affected systems, demanding a ransom for decryption. It has been observed targeting various sectors, including healthcare and financial services, with a global reach.
Detection coverage
- 1 YARA rules
Detection rules
- DITEKSHEN_INDICATOR_KB_ID_Ransomware_Thanos (yara-rule)
Reports & references
- pwc.co.uk — Pwc Cyber Threats 2020 A Year In Retrospect (report)
- CrowdStrike — Report2021Gtr (report)
- public.intel471.com — Ransomware As A Service 2020 Ryuk Maze Revil Egregor Doppelpaymer (report)
- Palo Alto Unit 42 — Prometheus Ransomware (report)
- medium.com — Quick Analysis Of Haron Ransomware Feat Avaddon And Thanos 1Ebb70F64Dc4 (report)
- Kaspersky — 104452 (report)
- securityboulevard.com — Midas Ransomware Tracing The Evolution Of Thanos Ransomware Variants (report)
- zscaler.com — Midas Ransomware Tracing Evolution Thanos Ransomware Variants (report)
- securityintelligence.com — Ransomware Encryption Goes Wrong (report)
- cybereason.com — Cybereason Vs. Prometheus Ransomware (report)
- Palo Alto Unit 42 — Thanos Ransomware (report)
- proofpoint.com — Hakbit Ransomware Campaign Against Germany Austria Switzerland (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Hakbit (report)
- sekoia.io — The Story Of A Ransomware Builder From Thanos To Spook And Beyond Part 1 (report)
- id-ransomware.blogspot.com — Hakbit Ransomware (report)
- go.recordedfuture.com — Cta 2020 0610 (report)
- carbonblack.com — Tau Threat Analysis Relations To Hakbit Ransomware (report)
- blog.cyble.com — Prometheus An Emerging Apt Group Using Thanos Ransomware To Target Organizations (report)
- justice.gov — Download (report)
- seqrite.com — Thanos Ransomware Evading Anti Ransomware Protection With Riplace Tactic (report)
- carbonblack.com — Tau Threat Analysis Hakbit Ransomware (report)