Bad Rabbit, New Ransomware Who Successfully Spreads In Europe

Cyber News - The new ransomware attack is found to spread like wildfire around Europe and has affected more than 200 major organizations, mainly in Russia, Ukraine, Turkey and Germany, in recent hours.

Dubbed "Bad Rabbit", a new ransomware attack targeting a corporate network, requires 0.05 bitcoins (approximately $ 285) for ransom from victims to open their systems.

According to an initial analysis provided by Kaspersky, the new ransomware is distributed through a download drive attack, using the Adobe Flash installer to entice victims to install malware unnoticed.

"No exploits are used, so the victim must manually run the malware dropper, which pretends to be an Adobe Flash installation. We have detected a number of compromised websites, all of which are news or media sites. "Kaspersky Lab says.

However, security researchers at ESET have detected Bad Rabbit malware as 'Diskcoder.D' - a new variant of ransomware Petya.

ESET believes that this new wave of ransomware attacks uses EternalBlue exploits - SMB vulnerabilities used by WannaCry and Petya to spread through the network.

Along with the list of commonly used credentials, Bad Rabbit ransomware also uses Mimikatz post-exploitation tools, to get the credentials of the affected system.

#ESET confirms Discoder/#Petya/#BadRabbit campaign live today, incorporating #Mimikatz distribuded via fake flash. More info soon. pic.twitter.com/lUpkmdG2ox

— Jiri Kropac (@jiriatvirlab) October 24, 2017

Affected organizations include Russian news agencies Interfax and Fontanka, payment systems in Kiev Metro, Odessa International Airport and the Ukrainian Infrastructure Ministry.

Из-за хакерской атаки в работе серверов Интерфакса возник сбой. Технические службы предпринимают все меры для восстановления работы систем.

— Интерфакс (@interfax_news) October 24, 2017

 The ransom note asks the victim to enter Tor's website to make a payment, which will count down 40 hours before the decryption price goes up.

Researchers are still analyzing the rabbits of Bad Rabbit to check whether there is a way to decrypt the computer without paying a ransom and how to prevent it from spreading further.