[SingCERT] Advisory on Bad Rabbit Ransomware
26 October 2017
A new ransomware known as Bad Rabbit was discovered by researchers from Kaspersky Lab and ESET on 24th October 2017. It is reported to have hit corporate networks in Ukraine and Russia, and appeared to be spreading to other countries. The ransomware bears some similarities to the NotPetya outbreak that caused extensive damages in June 2017, but also bear notable differences.
For example, unlike Notpetya, it does not exploit software vulnerabilities, but rely on the traditional click-and-infect method. Basically it tricks victims to download a fake Adobe Flash Installer when they visit compromised websites. Once infected, this ransomware will spread itself within the infected organisation’s network through Windows File Sharing protocol and infect other machines within this network.