The malware has apparently affected systems at three Russian websites, an airport in Ukraine and an underground railway in the capital city, Kiev.
The cyber-police chief in Ukraine confirmed to the Reuters news agency that Bad Rabbit was the ransomware in question.
Created By Fan of Game of Thrones
Unlike other recent malware epidemics which spread through more passive means, Bad Rabbit requires a potential victim to download and execute a bogus Adobe Flash installer file, thereby infecting themselves. It bears similarities to the WannaCry and Petya outbreaks earlier this year.
Whoever created Bad Rabbit appears to be a Game of Thrones fan, as the malware makes reference to Daenerys Targaryen’s dragons and Grey Worm, a beloved character who is definitely not the skin disease known as greyscale.
However, it is not yet known how far this new malware will be able to spread.
Head of Russian cyber-security firm Group-IB, Ilya Sachkov, said in some of the companies, the work has been completely paralysed – servers and workstations are encrypted.
Two of the affected sites are Interfax and Fontanka.ru.
Discourages Paying The Ransom
If Bad Rabbit infects your computer, it attempts to spread across the network using a list of usernames and passwords buried inside the malware. These credentials include passwords straight out of a worst passwords list
Meanwhile, US officials said they had “received multiple reports of Bad Rabbit ransomware infections in many countries around the world”.
The US computer emergency readiness team said it “discourages individuals and organisations from paying the ransom, as this does not guarantee that access will be restored”. Vyacheslav Zakorzhevsky at Kaspersky Lab said based on their data, most of the victims targeted by these attacks are located in Russia,
“We have also seen similar but fewer attacks in Ukraine, Turkey and Germany.”
Bad Rabbit encrypts the contents of a computer and asks for a payment – in this case 0.05 bitcoins, or about $280 (£213). Cyber-security firms, including Russia-based Kaspersky, have said they are monitoring the attack.
The malware is still undetected by the majority of anti-virus programmes, according to analysis by virus checking site Virus Total. The outbreak bears similarities to the WannaCry and Petya ransomware outbreaks that spread around the world causing widespread disruption earlier this year.
One security firm, Eset, has said that the malware was distributed via a bogus Adobe Flash update. Researcher Kevin Beaumont has posted a screenshot that shows Bad Rabbit creating tasks in Windows named after the dragons Drogon and Rhaegal in TV series Game of Thrones.