Arsgera - Fotolia
Bad Rabbit ransomware: How does it compare to other variants?
Bad Rabbit ransomware mimics other recent ransomware variants, such as NotPetya. Discover the similarities and differences between the two with expert Nick Lewis.
How does the Bad Rabbit ransomware compare to other recent ransomware variants? Are there any weaknesses in Bad...
Continue Reading This Article
Enjoy this article as well as all of our content, including E-Guides, news, tips and more.
Rabbit that can enable users to recover data?
As operating systems and antimalware tools begin to include protection against ransomware, ransomware itself has evolved by including standard encryption software, such as the open source DiskCryptor. The Bad Rabbit ransomware has incorporated these improvements to make it more effective and dangerous.
Both FireEye and Kaspersky have investigated Bad Rabbit ransomware, as it is similar to the NotPetya ransomware, also known as ExPetr or EternalPetya.
Along with the standard ransomware functionality, some of the similarities between Bad Rabbit and NotPetya include checking for a specific file before infecting a system, checking the running processes on the local system looking for antimalware utilities, and performing antiforensic steps to make the investigation of an incident more difficult. Likewise, both malware authors used the same code base and reused part of the code that previously worked effectively.
On the other hand, Bad Rabbit has an additional command-line argument that can skip the credential theft and lateral movement attack aspects, but it does not include the PsExec utility bundle. These differences could have been implemented to reduce the chance of being detected, as dumping credentials and scanning systems on the network are key indicators of compromise.
Kaspersky reported that there is one potential option to recover an endpoint infected with Bad Rabbit malware, as it doesn't delete shadow copies. Therefore, if shadow copies are enabled on the endpoint, then they could be used to recover data without paying the ransom.
Ask the expert:
Have a question about enterprise threats? Send it via email today. (All questions are anonymous.)
Dig Deeper on Threats and vulnerabilities
Related Q&A from Nick Lewis
What are port scan attacks and how can they be prevented?
Port scans provide data on how networks operate. In the wrong hands, this info could be part of a larger malicious scheme. Learn how to detect and ... Continue Reading
Explore benefits and challenges of cloud penetration testing
Cloud penetration testing presents new challenges for information security teams. Here's how a playbook from the Cloud Security Alliance can help ... Continue Reading
What are the best criteria to use to evaluate cloud service providers?
Many cloud providers are tight-lipped about internal security control details. Learn how to evaluate cloud security providers with certifications and... Continue Reading