Cyritex Security Labs | 2 variants of BadRabbit ransomware and 7 malicious tools have been added to the simulated attack library!

BadRabbit first appeared in October 2017. It shares many identical code implementations in functionality with the previous NotPetya ransomware, such as creating scheduled tasks for shutdown and reboot, traversing computers within the local network to propagate by reading current user passwords and built-in weak system passwords, and finally encrypting system files before prompting for decryption via Bitcoin payment.

Since June 2022, a new variant of the BadRabbit ransomware has been released, which has been captured by the Security Onion Security Lab. It has also been integrated into the simulated attack library of the Security Onion Verification, continuously bolstering the Security Onion Verification's ransomware defense assessment service.

▌Introduction to the New Variant of BadRabbit

The execution of this new variant causes dispci.exe (and other binary files) to be dropped into the %WINDIR% directory, which is responsible for encrypting files and modifying the boot-loader. BadRabbit is an executable file and disk-encrypting ransomware written in C/C++, using an embedded DiskCryptor driver to perform disk encryption. It can also use an embedded MIMIKATZ payload to obtain credentials and perform lateral movement. Attackers can also specify credentials and systems via command-line arguments to conduct lateral movement. Its code borrows from the famous ETERNALPETYA interruption tool, including system enumeration and lateral movement techniques. It is primarily distributed through compromised web servers hosting the BACKSWING reconnaissance tool.

▌Simulated Attack Library Update

You can now select simulations of 2 ransomware variants of BadRabbit as well as downloads of other malicious tool samples on our platform. This allows you to test the detection and defense capabilities of your cybersecurity detection and defense measures, as well as endpoint/host defenses, against these 2 variants and their associated malicious tools.

Specifically, you can truly execute the ransomware through the protected sandbox of Security Onion Verification. This helps you determine whether your current endpoint/host defense measures can fend off its attacks at the very last second, without having to worry about various impacts brought by its destructiveness in case the defense fails. The protected sandbox of Security Onion Verification will ensure its safety without causing any impact.