Bad Rabbit: the fake Flash ransomware that hit Kyiv in 2017

On October 24, 2017, employees at the Kyiv metro, Odessa airport and Russian news agencies found the same screen: black background, red letters and a demand for 0.05 bitcoin, about $280 at the time, to get their computer back. The attack was called Bad Rabbit. It arrived four months after NotPetya, so everyone's first thought was: "again?"

What was Bad Rabbit?

What is Bad Rabbit?

Bad Rabbit was ransomware that encrypted files and the entire disk of Windows computers, disguised as an Adobe Flash Player update and spread through compromised websites, mainly in Russia and Ukraine. Once inside a machine, it tried to jump to others on the same network.

According to Cyberscoop and Dark Reading, targets included the Kyiv metro, Odessa International Airport, Ukraine's infrastructure and finance ministries and the Russian agency Interfax. Kaspersky said most victims were in Russia. Cases were also reported in Turkey, Bulgaria and Germany.

How the infection started

Cisco Talos' analysis describes a drive-by attack: the visitor opened a legitimate but compromised website and was redirected to download a file called install_flash_player.exe. The dropper did not exploit any vulnerability to get in. The victim had to run the file themselves.

That is the most instructive part of the case: no sophisticated zero-day at the front door, just an "update" button that looked ordinary. The same principle applies to watering hole attacks, where the site the victim visits is the weapon.

How it spread across the network

After the first machine, the lateral movement component took over. According to Talos, it combined two things:

• A built-in list of weak credentials, tried against other machines over SMB.
• A Mimikatz-like tool to pull credentials from the memory of already infected machines and reuse them. It is the same logic as pass-the-hash.

Talos also observed EternalRomance, an exploit tied to the MS17-010 flaw that had already shown up in NotPetya. It found no evidence of EternalBlue, which was at the center of WannaCry. ESET, for its part, said the samples used at the Kyiv metro were a variant of the Petya family.

How is it related to NotPetya?

Was Bad Rabbit made by the same authors as NotPetya?

It was never proven. Researchers found shared code and techniques, but that is not enough to prove authorship.

Intezer pointed to code copied from NotPetya, and Malwarebytes described many similar elements. The difference is that Bad Rabbit swapped the Petya core for a legitimate disk encryption tool, DiskCryptor, along with a legitimate driver. The similarity percentages published at the time varied widely from source to source, so be wary of any exact number.

Another important difference: Malwarebytes noted that with Bad Rabbit the data could be recovered with the key, unlike NotPetya, which behaved like a disk wiper dressed up as ransomware. Before the attack, Ukraine's security service (SBU) had warned on October 14 of a new wave similar to NotPetya.

Practical lessons

1. Software updates don't come from pop-ups. Plugins, drivers and browsers update through the program itself or the official store, never through a button on a web page. Flash is gone, by the way: Adobe ended support on December 31, 2020.
2. Weak, reused passwords multiply the damage. If one admin credential opens dozens of machines, the ransomware opens them too. Use unique passwords and separate accounts for administration.
3. Patch MS17-010. The EternalRomance flaw had a Microsoft patch since March 2017. Anyone who applied it stayed out of one of the propagation routes.
4. Keep a backup ransomware can't reach. See the 3-2-1 backup rule: an offline copy is worth more than any antivirus when an incident hits.
5. Don't pay right away. US-CERT recommended not paying the ransom. Isolate the machines, disconnect them from the network and activate the response plan.

The bigger lesson

Bad Rabbit did less damage than NotPetya and WannaCry, but it showed that modern ransomware is a set of reused parts: a social engineering trick at the entrance, stolen credentials in the middle and an old unpatched flaw as backup. Cutting any one of those parts changes the outcome.

If you want to go deeper, read our guide on how to protect yourself from ransomware.

Sources

• Cisco Talos — Bad Rabbit
• Cyberscoop — BadRabbit ransomware spreading across Ukraine, Russia
• Help Net Security — NotPetya successor Bad Rabbit
• Malwarebytes — BadRabbit: a closer look
• Bitdefender Labs