Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-05 21:05:36 UTC
Home > List all groups > List all tools > List all groups using tool BadRabbit
 Tool: BadRabbit
Names BadRabbit
Category Malware
Type Ransomware
Description
(Talos) There have been several large scale ransomware campaigns over the last several months.
This appears to have some similarities to NotPetya in that it is also based on Petya ransomware.
Major portions of the code appear to have been rewritten. The distribution does not appear to have
the sophistication of the supply chain attacks we have seen recently.
Despite initial reports, we currently have no evidence that the EternalBlue exploit is being
leveraged. However, we identified the usage of the EternalRomance exploit to propagate in the
network. This exploit takes advantage of a vulnerability described in the Microsoft MS17-010
security bulletin. The vulnerability was also exploited during the Nyetya campaign.
Information
AlienVault OTX Last change to this tool card: 21 May 2020
Download this tool card in JSON format
All groups using tool BadRabbit
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=d8583406-a007-40a0-97a4-217300e1529f
Page 1 of 2

Changed Name Country Observed
APT groups
  TeleBots 2015-Oct 2020
1 group listed (1 APT, 0 other, 0 unknown)
Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=d8583406-a007-40a0-97a4-217300e1529f
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=d8583406-a007-40a0-97a4-217300e1529f
Page 2 of 2