Last updated: 31/10/2017 11:00
Integrity360 is actively monitoring a new Ransomware threat known as "Bad Rabbit". This ransomware variant is delivered via malicious websites that instructs the user to update Flash. Upon clicking on the update Flash pop up, a malware dropped is downloaded and executed. All files on the system are encrypted and the master boot record replaced. Once the PC boots, a ransom note is displayed similar to what was seen with NotPetya a number of months ago. The malware also includes techniques to spread laterally through the network. The first technique is using a hacking tool known as Mimikatz, which is able to obtain passwords from memory on the infected system. The second, via the EternalBlue exploit (MS17-010) seen in WannaCry. The malware also has a hard coded list of usernames and passwords.
There has been no evidence of the ransomware being delivered via phishing emails, however given this is always a likely attack vector, users should be cautious when clicking links or opening attachments from unexpected sources. So far the attack vector appears to be via users visiting compromised websites directly.
Integrity360 recommends the following:
Integrity360 will continue to actively monitor this threat and provide updates on this page as new intelligence becomes available.
If you suspect that you have been compromised, please do not hesitate to contact us for support.