New “Bad Rabbit” ransomware targets corp networks in Ukraine, Turkey, Germany, infects devices through hacked Russian media sites using NotPetya type methods
There is a connection between Bad Rabbit and Not Petya Waqas / HackRead : Bad Rabbit ransomware spreading like wildfire but there is a way out Dell Cameron / Gizmodo : ‘Bad Rabbit’ Ransomware Strikes Russia and Ukraine Alex Perekalin / Kaspersky Lab official blog : Bad Rabbit: A new ransomware epidemic is on the rise Dani Deahl / The Verge : New BadRabbit ransomware spreads through Eastern Europe Nick Biasini / Talos Blog : Threat Spotlight: Follow the Bad Rabbit Bill Brenner / Naked Security : Bad Rabbit ransomware outbreak Tom Allen / Inquirer : Bad Rabbit: Ransomware linked to NotPetya hits Russia and Ukraine Rob Thubron / TechSpot : NotPetya ransomware variant ‘Bad Rabbit’ is spreading fast Mark Wycislik-Wilson / BetaNews : Bad Rabbit ransomware spreads across Eastern Europe with echoes of WannaCry and Petya Rob Price / Business Insider : There's a new ransomware attack called ‘Bad Rabbit’ spreading in Europe Alex Hern / The Guardian : Bad Rabbit: Game of Thrones-referencing ransomware hits Europe John Kennedy / Silicon Republic : Bad Rabbit: What we know about the latest virus besieging Europe Eduard Kovacs / SecurityWeek : Bad Rabbit Linked to NotPetya, but Not as Widespread Catalin Cimpanu / BleepingComputer.com : Bad Rabbit Ransomware Outbreak Hits Eastern Europe Sean Michael Kerner / eWeek : Bad Rabbit Ransomware Spreads Across Ukraine, Russia Paul Wagenseil / Tom's Guide : Bad Rabbit Ransomware: What It Is, What to Do Thomas Fox-Brewster / Forbes : Russian News Hacked To Launch Global Ransomware Attack Robert McMillan / Wall Street Journal : New Ransomware Outbreak Spreads Through U.S., Russia and Ukraine US-CERT : Multiple Ransomware Infections Reported Malwarebytes Labs : BadRabbit: a closer look at the new version of Petya/NotPetya Bogdan Botezatu / Bitdefender Labs : Bad Rabbit Ransomware Strikes Ukraine, Likely related to GoldenEye Danny Palmer / ZDNet : Bad Rabbit ransomware: A new variant of Petya is spreading, warn researchers Selena Larson / CNNMoney : New ransomware attack hits Russia and spreads around globe Jason Murdock / International Business Times : Another global hack? ‘BadRabbit’ ransomware spreading rapidly in Ukraine, Russia John Leyden / The Register : Watership downtime: BadRabbit encrypts Russian media, Ukraine transport hub PCs BBC : ‘Bad Rabbit’ ransomware strikes Ukraine and Russia Sead Fadilpaši / IT ProPortal : New Bad Rabbit ransomware hitting Eastern Europe Jay Rosenberg / Intezer : NotPetya Returns as Bad Rabbit Samantha Pierre / Palo Alto Networks Blog : Palo Alto Networks Protections Against Bad Rabbit Ransomware Attacks Taylor Hatmaker / TechCrunch : A new ransomware attack called Bad Rabbit looks related to NotPetya Christopher Budd / Palo Alto Networks Blog : Threat Brief: Information on Bad Rabbit Ransomware Attacks Dan Goodin / Ars Technica : New wave of data-encrypting malware hits Russia and Ukraine Mallory Locklear / Engadget : New ransomware is causing major issues across Europe and Russia Bloomberg : Russian News Agency Interfax Faces ‘Unprecedented’ Hacker Attack Dan Thorp-Lancaster / Windows Central : New ‘Bad Rabbit’ ransomware attack spreading across Europe Steve Ragan / CSO : BadRabbit ransomware attacks multiple media outlets Surur / MSPoweruser : Bad Rabbit is the latest ransomware currently ravishing Russian computer networks Tweets: @gossithedog : ESET have the best analysis of #BadRabbit I've seen. Watering hole Flash update + Mimikatz + SMB lateral movement http://www.welivesecurity.com/ ... Josep Albors / @josepalbors : Analysis by @ESET provides useful info about #BadRabbit, including IOCs, file hashes, C&C, attack vectors and more http://www.welivesecurity.com/ ... Lorenzo Franceschi-B / @lorenzofb : A new ransomware called Bad Rabbit (variant of Petya) is spreading through Ukraine and Russia http://motherboard.vice.com/ ... Eric Geller / @ericgeller : .@kaspersky researchers say #BadRabbit ransomware attack was targeted at corporate networks using fake Flash installer placed on news/media websites. Almost 200 targets total. http://securelist.com/... http://twitter.com/...
Context & Ripple Effects
Bad Rabbit lands five months after the June outbreak that Eset and Recorded Future identified as a Petya variant riding the NSA's EternalBlue exploit — a lineage researchers now say it shares, with Kaspersky, Cisco Talos, Bitdefender and Palo Alto all publishing analyses within hours of the first infections. The delivery method is the notable change: instead of worming from an initial foothold, it waits behind a fake Flash update on hacked Russian media sites, a watering-hole approach in the family of the NotPetya attack that later caused an estimated $10B+ in damages.
The geographic footprint — Ukraine hit hardest again, plus Turkey, Germany and Russia itself — repeats the targeting pattern of the earlier wave, which is why US-CERT issued advisories covering infections across the U.S., Russia and Ukraine almost immediately.
First-order effects
- Corporate networks in Ukraine, Turkey, Germany and Russia face disk-encryption demands right now, with propagation driven by Mimikatz credential theft and SMB lateral movement — so any Windows machine sharing credentials with an infected host is exposed until isolated.
- Defenders get same-day support: Palo Alto Networks ships protections and a threat brief, Kaspersky publishes analysis, and US-CERT distributes advisories, giving enterprises concrete indicators to block.
Second-order effects
- Enterprises burned by the June Petya-variant outbreak will treat unpatched SMB exposure and shared local-admin credentials as board-level risk, accelerating internal segmentation work rather than waiting for vendor patches.
- Trust in mainstream media sites as ad/inventory sources takes a hit — companies that allow staff browsing of Russian-language news outlets now face pressure to whitelist less, since the infection vector was the sites themselves.
Third-order effects
- If the NotPetya-to-Bad Rabbit lineage holds, ransomware keeps consolidating into a professionalized, apparently Russia-tolerated industry — a trajectory later visible when US investigators traced payments to firms in Moscow's Federation Tower East and when the Sinclair attackers were linked to sanctions-listed Evil Corp operating under new names.
- That state-tolerance pattern is what pushed a 60+ expert task force to call for coordinated US-allied action against ransomware, shifting the burden from enterprise patching (which analysts argue is no longer feasible against multi-million-dollar gangs) toward international policy.
The trend: Ransomware is evolving from opportunistic encryption into a recurring, state-tolerated criminal industry whose outbreaks — Petya, NotPetya, Bad Rabbit — increasingly double as geopolitical instruments, forcing the response to migrate from IT departments to governments.