Log in Request a demo

Malware profile

Bad Rabbit

Also known as Win32/Diskcoder.D

Bad Rabbit is self-propagating ransomware for Windows.

In short

Bad Rabbit is self-propagating ransomware for Windows. MITRE ATT&CK says it affected the Ukrainian transportation sector in 2017 and also targeted organizations and consumers in Russia. The UK government attributes the October 2017 attack to the GRU, Russia's military intelligence service.

Last updated 9 October 2026

Profile MapMalware
  1. Names3names in public reportsBad Rabbit · BadRabbit · Win32/Diskcoder.D
  2. Techniques15ATT&CK techniques listedInitial Access · Execution · Stealth
  3. Linked Groups1groups that use itSandworm

In one minute

What it is
Self-propagating Windows ransomware that MITRE says affected the Ukrainian transportation sector in 2017 and also targeted organizations and consumers in Russia.
What it does
Encrypts files and disks, and MITRE says it installs a modified bootloader that stops normal boot-up. It spreads inside networks with the EternalRomance SMB exploit and stolen credentials.
Who uses it
Attributed by the UK Government and NCSC, in a statement of 4 October 2018, to the GRU (NCSC: high confidence, almost certainly responsible). In 2020 the UK linked the BadRabbit attack to the GRU unit known as Sandworm. MITRE also lists Sandworm Team as a user.
How it gets in
Watering holes on popular sites with injected JavaScript, then a fake Flash Player installer that the user runs, according to MITRE.
What to do first
Patch Windows systems, keep offline backups, and do not pay the ransom. Follow the NCSC steps for stopping malware spreading across a network.

What it does

CISA described Bad Rabbit as ransomware that restricts user access to an infected machine until a ransom is paid, and called it a suspected variant of Petya. It advised against paying, because payment does not guarantee that access will be restored.

The UK government says the October 2017 attack encrypted hard drives and rendered IT inoperable, with disruption to the Kyiv metro, Odessa airport, Russia's central bank and two Russian media outlets.

Names

Public sources use several names for this malware.

Names
NameWhere it appears
Bad RabbitMITRE ATT&CK software S0606 and CISA alert "Multiple Ransomware Infections Reported"[1, 2]
BadRabbitSpelling used in the UK Government statements of 4 October 2018 and 20 February 2020[3, 4]
Win32/Diskcoder.DMITRE ATT&CK Associated Software[1]

What it can do

What MITRE ATT&CK lists this malware as doing, by tactic. Each id opens our technique page where one exists, otherwise MITRE.

Initial Access

  • Drive-by Compromise T1189

    It spread through watering holes on popular sites, with JavaScript injected into the page body or a .js file.[1]

Execution

  • User Execution: Malicious File T1204.002

    It ran after a user installed an executable that was disguised as a Flash installer.[1]

  • System Services: Service Execution T1569.002

    It drops infpub.dat into the Windows directory and runs it through the service control manager and rundll.[1]

  • Scheduled Task/Job: Scheduled Task T1053.005

    The infpub.dat file creates a scheduled task that starts a malicious executable.[1]

  • Native API T1106

    It has used various Windows API calls.[1]

Stealth

  • Masquerading: Match Legitimate Resource Name or Location T1036.005

    It posed as a Flash Player installer using the file name install_flash_player.exe.[1]

  • System Binary Proxy Execution: Rundll32 T1218.011

    It used rundll32 to launch a malicious DLL named infpub.dat.[1]

Privilege Escalation

  • Abuse Elevation Control Mechanism: Bypass User Account Control T1548.002

    It tried to bypass User Account Control to gain administrative privileges.[1]

Credential Access

  • OS Credential Dumping: LSASS Memory T1003.001

    It used Mimikatz to harvest credentials from the victim's machine.[1]

  • Brute Force: Password Spraying T1110.003

    The infpub.dat file uses NTLM login credentials to brute force Windows machines.[1]

Discovery

  • Network Share Discovery T1135

    It lists open SMB shares on internal victim networks.[1]

  • Process Discovery T1057

    It can list all running processes in order to compare hashes.[1]

Lateral Movement

  • Exploitation of Remote Services T1210

    It used the EternalRomance SMB exploit to spread through victim networks.[1]

Impact

  • Data Encrypted for Impact T1486

    It encrypted files and disks using AES-128-CBC and RSA-2048.[1]

  • Firmware Corruption T1495

    It used an executable that installs a modified bootloader to prevent normal boot-up.[1]

How it spreads

MITRE says Bad Rabbit spread through watering holes on popular sites, by injecting JavaScript into the HTML body or a .js file. It says the malware was run when users installed an executable disguised as a Flash Player installer. Inside a network, MITRE says it used the EternalRomance SMB exploit, enumerated open SMB shares, and used NTLM login credentials to brute force Windows machines. MITRE also says it used Mimikatz to harvest credentials from the victim's machine.

Timeline

  1. October 2017

    Bad Rabbit attack

    The UK Government says BadRabbit ransomware encrypted hard drives and rendered IT inoperable, disrupting the Kyiv metro, Odessa airport, Russia's central bank and two Russian media outlets.[3]

  2. October 24, 2017

    CISA alert

    US-CERT reported it had received multiple reports of Bad Rabbit ransomware infections in many countries, called it a suspected variant of Petya and discouraged paying the ransom.[2]

  3. October 4, 2018

    UK attribution

    The UK Government and NCSC said the NCSC assesses with high confidence that the GRU was almost certainly responsible for the BadRabbit attack.[3]

  4. February 20, 2020

    UK links BadRabbit to GTsST

    A UK statement on Georgia lists BadRabbit among the operations of the GRU unit also known as Sandworm, GTsST or unit 74455.[4]

Detection and defense

  1. Patch and update software

    MITRE lists regular patch management on endpoints and servers as a mitigation for exploitation of remote services. CISA warned in its Bad Rabbit alert that unpatched and unsupported software raises the risk of ransomware spreading. NCSC advises installing security updates as soon as they become available.[7, 2, 6]

    Counters: T1210

  2. Segment the network

    MITRE advises segmenting networks and systems to reduce access to critical systems. NCSC advises segregating obsolete platforms from the rest of the network and removing user permissions that are no longer needed, to limit how far malware can spread.[7, 6]

    Counters: T1210 T1135 T1110.003

  3. Keep offline backups

    NCSC says up-to-date backups are the most effective way of recovering from a ransomware attack, and that they should be kept offline and separate from the network.[6]

    Counters: T1486 T1495

  4. Only allow trusted programs to run

    NCSC advises centrally managing devices so that only applications trusted by the organization can run, for example with AppLocker. This fits a fake installer.[6]

    Counters: T1204.002 T1036.005

  5. Train staff

    NCSC advises security education and awareness training for staff. Pairing it with the fake Flash installer is our reading.[6]

    Counters: T1204.002 T1189

  6. Limit admin rights

    NCSC advises that system administrators avoid using their accounts for email and web browsing, so malware cannot run with high privilege. Pairing it with UAC bypass and credential theft is our reading.[6]

    Counters: T1548.002 T1003.001

  7. Official resources and reporting

    CISA's alert "Multiple Ransomware Infections Reported" asks victims to report incidents to the Internet Crime Complaint Center (IC3) and points to US-CERT alerts TA17-181A and TA17-132A on other ransomware events. We found no official page with detection signatures for Bad Rabbit itself.[2]

    Counters: T1486

Questions

What is Bad Rabbit?

MITRE ATT&CK calls it self-propagating ransomware that affected the Ukrainian transportation sector in 2017 and also targeted organizations and consumers in Russia. CISA called it a suspected variant of Petya.

Who was behind Bad Rabbit?

The UK Government and NCSC attributed the October 2017 BadRabbit attack to the GRU on 4 October 2018, with high confidence. A UK statement of 20 February 2020 lists BadRabbit among the work of the GRU unit known as Sandworm. MITRE also lists Sandworm Team as a user.

How did Bad Rabbit spread?

MITRE says it spread through watering holes on popular sites and ran when users installed a fake Flash Player installer. Inside networks it used the EternalRomance SMB exploit and credentials.

Should victims pay the Bad Rabbit ransom?

CISA discouraged paying, because payment does not guarantee that access will be restored. It also asked victims to report incidents to the Internet Crime Complaint Center (IC3).

What did the UK say Bad Rabbit disrupted?

The UK Government says it disrupted the Kyiv metro, Odessa airport, Russia's central bank and two Russian media outlets.

In our research

  1. What Should You Know About Ransomware September 2022
  2. Sandworm Threat group

Sources

  1. Bad Rabbit, Software S0606 MITRE ATT&CKSupports: Description, alias, platform, techniques and the Sandworm Team link.
  2. Multiple Ransomware Infections Reported CISA (US-CERT alert)Supports: Bad Rabbit reports in many countries, suspected Petya variant, advice not to pay, IC3 reporting.
  3. UK exposes Russian cyber attacks UK Foreign and Commonwealth Office and NCSCSupports: October 2017 BadRabbit disruption and NCSC attribution to the GRU, 4 October 2018.
  4. UK condemns Russia's GRU over Georgia cyber-attacks UK Foreign and Commonwealth Office and NCSCSupports: 20 February 2020 statement listing BadRabbit among operations of the unit known as Sandworm.
  5. Sandworm Team, Group G0034 MITRE ATT&CKSupports: Sandworm Team attributed to GRU GTsST unit 74455.
  6. Mitigating malware and ransomware attacks NCSC (UK)Supports: Backups, patching, segregation, trusted applications and training.
  7. Exploitation of Remote Services, Technique T1210 MITRE ATT&CKSupports: Mitigations: update software, network segmentation.

Browse the threat library

Keep exploring

Knowledge Hub

Article

What Should You Know About Ransomware

Ransomware is an easy way to profit since attackers directly demand ransom. They do not have to infiltrate sensitive data and sell them to…

Read more

Glossary term

Ransomware

Ransomware is malware that encrypts files and systems so they become unusable until a ransom is paid.

Read more

Glossary term

MITRE ATT&CK

MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations.

Read more

Technique

Drive-by Compromise

Drive-by Compromise is a way for attackers to gain access to a computer when a person visits a website during normal browsing.

Read more