Published on October 31, 2017
Ransomware On The Rise With Bad Rabbit
For about a week now, a new ransomware campaign has been sweeping across computers. This is the third major ransomware campaign after WannaCry and NotPetya this year. Securonix Threat Research Labs has been tracking this campaign since its inception (technical details here), and here is what we know so far.
Initial targets are across Europe
The ransomware has struck organizations across Eastern Europe, with reports coming from Russia, Ukraine as well as parts of Turkey, Poland, and Germany. However, the ransomware does not seem to be limited to this geography and will certainly spread if precautionary steps are not taken.
Ransomware: Payment via Bitcoin
As with most other ransomware strains, Bad Rabbit makes itself very visible as soon as the encryption part of the attack is completed. The device user is informed that their files are no longer accessible to them, and they may retrieve the files with a payment of 0.05 Bitcoin, which currently converts to about $285. This is in line with other variants that also demand initial payments of $300 - $500. The user has 40 hours to make the payment (a countdown timer is shown) after which the ransom goes up.
Infection Uses Fake Flash Plugin Update
Lateral Movement Is Possible
The Bad Rabbit ransomware code, once downloaded to a user's device has the capability to scan for, and move laterally via SMB shares. The ransomware utilizes default credentials for SMB user and password combinations to access other devices on the organization's network. This capability, of course, makes the entire organization vulnerable to a crippling, large-scale ransomware attack and associated loss of service on affected devices/applications.
Common Sense Prevention Steps
Ransomware is, unfortunately, becoming a highly effective attack vector used by hackers to quickly and easily monetize their effort. While detection is critical to slow down the spread of Bad Rabbit across organizational networks, internet users must follow the basic guidelines that govern safe online activity. These habits include:
- Browsing only to safe sites and staying away from questionable web content.
- Maintaining a healthy suspicion of any update or download requests from websites
- If you suspect you have been a victim, quickly escalating the threat to your IT security teams
Securonix equips all implementations with the necessary machine learning algorithms and Spotter threat hunting queries for SOC analysts to find undiscovered instances of Bad Rabbit, and to quickly gather the information necessary to prevent a major impact to their organization.