BadRabbit Ransomware

The BadRabbit Ransomware is a family of file-locking Trojans that can damage media by encrypting it, collect passwords to gain improved access to vulnerable systems, and display screen-locking ransom notes. Threat actors are installing the BadRabbit Ransomware with fake Flash updates that they may circulate on corrupted websites or through other means, such as spam e-mails. Users should protect their files by having anti-malware products capable of deleting the BadRabbit Ransomware on sight and maintaining adequate backup safeguards.

Trojan Bunnies Hopping Borders

The age of threat actors avoiding attacking Russian targets has long since passed, and the newfound vulnerability of the nation is, perhaps, best showcased with the BadRabbit Ransomware campaign. This series of attacks is similar to those of the '.wcry File Extension' Ransomware family structurally, although the BadRabbit Ransomware isn't a direct relative. Attacks that malware experts can confirm are for more than just Russian entities, but also Ukrainian subway systems, South Korea, Europe, and the United States.

The group of threat actors organizing the BadRabbit Ransomware's campaign distribute their threat as a fake patch for the Adobe's Flash, which is most likely installing through website exploit kits or e-mail-based vulnerabilities. The BadRabbit Ransomware uses a secure encoding method leveraging a combination of the AES and RSA ciphers to block the infected system's media, which includes documents, pictures, spreadsheets and archives. The enciphering routine also adds an extra, internal 'encrypted' marker to each file, in addition to the traditional practice of appending a new extension ('.encrypted').

When it completes its file-locking routine, the BadRabbit Ransomware restarts the computer and forces it to load a screen-locking startup screen that bypasses Windows. This screen gives the user a link to the threat actor's TOR website, for paying a ransom to purchase the BadRabbit Ransomware's decryption code. Although malware experts are noting that the BadRabbit Ransomware's initial ransom fee is unusually cheap at 0.05 Bitcoins, the website does include a time limit before raising it.

Snaring a Pest before It Snatches Your Files

With less than three hundred dollars required for paying, victims are likely to be tempted into submitting to the BadRabbit Ransomware's ransoming demands. However, the Trojan's insistence on Bitcoins always leaves open the chance that threat actors will accept their money without giving any decryption assistance back to the user. Another security risk malware experts point out as significant is the BadRabbit Ransomware's modular use of the Mimikatz app, which could help the crooks to collect login combinations and passwords to compromise new targets, especially locally networked ones.

The BadRabbit Ransomware's threat actors are highly active in distributing their threat to different targets, including Russian news agencies and other, for-profit business sectors. Besides the standard precautions, such as backing up your media, recommended defenses against the BadRabbit Ransomware include disabling the Windows WMI service temporarily if it's practical. With the decryption of any files that this threat locks being unlikely, all users should emphasize security practices that help them block and remove the BadRabbit Ransomware with anti-malware programs before its attack routine finishes.

The BadRabbit Ransomware campaign is relatively sophisticated and makes practical use of default Windows features for installing itself and conducting attacks afterward. With so many companies around the world already harmed by its activities, all PC workers with Internet access should be on guard for exploits that could let this Trojan hop into their networks.

Technical Details