Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

Kaspersky Security Blog

Check Point Research

CVE Database V5

AlienVault OTX General

SANS ISC Handlers Diary

SecurityWeek

Threatpost

The Hacker News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit NetSec

Reddit InfoSec News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

OSINT - Return of Not Petya as Bad Rabbit Diskcoder, yes those two are the same!

The threat described involves the resurgence of ransomware variants linked to the infamous NotPetya and Bad Rabbit malware families, collectively referred to here as "Not Petya as Bad Rabbit Diskcoder." Both NotPetya and Bad Rabbit are ransomware strains that emerged around 2017 and are known for their destructive impact on infected systems. NotPetya masqueraded as ransomware but was primarily a wiper designed to cause widespread damage, while Bad Rabbit was a ransomware outbreak that spread via fake Adobe Flash installers, encrypting files and demanding ransom payments. This OSINT report highlights that these two malware strains are essentially the same or closely related, indicating a possible re-emergence or variant combining characteristics of both. The malware operates by encrypting user data and potentially disrupting workstation communications, which can severely impact business operations. The report suggests preventive measures such as maintaining robust backup and restore processes and restricting workstation communication to limit lateral movement within networks. Although the severity is marked as low in the source, the technical threat level is noted as 3, indicating a moderate concern. No known exploits in the wild are reported currently, and no specific affected versions or patches are identified, which suggests this is an intelligence observation rather than an active widespread campaign at the time of reporting.

Detailed information about OSINT - Return of Not Petya as Bad Rabbit Diskcoder, yes those two are the same!. Get real-time updates, technical details, and mitig

OSINT - Return of Not Petya as Bad Rabbit Diskcoder, yes those two are the same! - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - Bad Rabbit: Not-Petya is back with improved ransomware

Bad Rabbit is a ransomware strain that emerged in October 2017 and is considered a variant or evolution of the NotPetya ransomware attacks that occurred earlier the same year. It is designed to encrypt victims' files and demand a ransom payment for decryption keys. Unlike NotPetya, which was primarily a wiper disguised as ransomware, Bad Rabbit improved its ransomware capabilities, making it a more traditional ransomware threat. The malware typically spreads through drive-by downloads from compromised websites, masquerading as a fake Adobe Flash installer. Once executed, it encrypts files on the infected system and displays a ransom note demanding payment in Bitcoin. Bad Rabbit also attempts to propagate laterally within networks by leveraging known vulnerabilities and using credential harvesting techniques to move between workstations. However, it does not appear to exploit zero-day vulnerabilities or have widespread exploits in the wild beyond initial infection vectors. The technical details indicate a moderate threat level, with a focus on backup and restore processes and restricting workstation communication as preventive measures. The ransomware targets Windows systems and aims to disrupt business operations by denying access to critical data.

Detailed information about OSINT - Bad Rabbit: Not-Petya is back with improved ransomware. Get real-time updates, technical details, and mitigation strategies.

OSINT - Bad Rabbit: Not-Petya is back with improved ransomware - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - BadRabbit Ransomware Compiled by ThaiCERT, a member of the Electronic Transactions Development Agency

BadRabbit ransomware is a malware strain first observed in October 2017, primarily targeting Windows-based systems. It is a disk-encrypting ransomware that spreads through fake Adobe Flash Player installers, tricking users into executing the malicious payload. Once executed, BadRabbit encrypts files on the infected system and demands a ransom payment in Bitcoin to decrypt the data. The ransomware uses a hardcoded list of target domains and IP addresses to determine whether to activate its payload, indicating some level of targeting or geographic filtering. Unlike some ransomware variants, BadRabbit does not appear to exploit vulnerabilities autonomously but relies on social engineering to infect victims. It also attempts to propagate laterally within networks by leveraging legitimate Windows tools such as WMIC and PsExec, which can allow it to spread to other machines if credentials are compromised or weak. The malware overwrites the Master Boot Record (MBR) to display the ransom note upon system reboot, effectively locking users out of their systems until the ransom is paid or the system is restored. Although the threat level is considered low in the provided data, BadRabbit caused significant disruption in 2017, particularly in Eastern Europe and Russia. The ransomware does not require user authentication but does require user interaction to initiate infection (i.e., running the fake Flash installer). No known exploits in the wild are reported beyond the social engineering vector. Mitigation strategies include restricting workstation communication to prevent lateral movement and maintaining robust backup and restore processes to recover encrypted data without paying ransom.

Detailed information about OSINT - BadRabbit Ransomware Compiled by ThaiCERT, a member of the Electronic Transactions Development Agency. Get real-time updates,

OSINT - BadRabbit Ransomware Compiled by ThaiCERT, a member of the Electronic Transactions Development Agency - Live Threat Intelligence - Threat Radar | OffSeq.com

Bad Rabbit ransomware is a malware threat first identified in October 2017, classified as ransomware. It primarily spreads through drive-by downloads masquerading as Adobe Flash installer updates, targeting Windows-based systems. Once executed, Bad Rabbit encrypts files on the infected system, appending a specific extension to encrypted files and displaying a ransom note demanding payment in Bitcoin to restore access. The ransomware uses a combination of symmetric and asymmetric encryption to lock user data, making recovery without the decryption key difficult. Unlike some ransomware variants, Bad Rabbit does not appear to exploit known vulnerabilities directly but relies on social engineering and lateral movement techniques within networks, including the use of legitimate Windows tools such as Mimikatz to harvest credentials and propagate. The threat level is considered moderate, with a low severity rating assigned in the source data, likely reflecting limited impact or spread compared to other ransomware outbreaks. Mitigation strategies focus on maintaining robust backup and restore processes and restricting unnecessary communication between workstations to prevent lateral movement. No known exploits in the wild beyond the initial infection vector have been documented, and no CVSS score is available for this threat.

Detailed information about OSINT - Bad Rabbit ransomware. Get real-time updates, technical details, and mitigation strategies.

OSINT - Bad Rabbit ransomware - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - Bad Rabbit ransomware

OSINT - Spora - the Shortcut Worm that is also a Ransomware

Spora is a malware strain identified as both a shortcut worm and ransomware, first reported in early 2017. It propagates by creating malicious shortcut files that facilitate its spread across removable drives and network shares, enabling it to infect multiple systems within an environment. Once executed, Spora encrypts user files and demands a ransom payment for decryption, classifying it firmly within ransomware threats. Unlike some ransomware variants, Spora does not rely on external command-and-control servers for key management, which complicates recovery efforts without backups. The worm-like behavior allows it to spread autonomously, increasing the infection footprint rapidly. The malware's infection vector typically involves user interaction, such as opening a compromised shortcut file, but its propagation mechanism can lead to widespread compromise within a networked environment. Despite its low severity rating at the time of discovery, Spora's dual nature as both a worm and ransomware makes it a persistent threat, especially in environments lacking robust endpoint protections and backup strategies. The absence of known exploits in the wild suggests limited active targeting or detection at the time, but the likelihood of infection remains very high given its propagation methods and ransomware payload.

Detailed information about OSINT - Spora - the Shortcut Worm that is also a Ransomware. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:preventive-measure="backup and restore process"'

Stop chasing alerts. Route them.

Filter Threats