H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

Bad Rabbit

[Bad Rabbit](https://attack.mitre.org/software/S0606) is a self-propagating ransomware that affected the Ukrainian transportation sector in 2017. [Bad Rabbit](https://attack.mitre.org/software/S0606) has also targeted organizations and consumers in Russia. (Citation: Secure List Bad Rabbit)(Citation: ESET Bad Rabbit)(Citation: Dragos Apr 2019)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[Bad Rabbit](https://attack.mitre.org/software/S0606) is a self-propagating ransomware that affected the Ukrainian transportation sector in 2017. [Bad Rabbit](https://attack.mitre.org/software/S0606) has also targeted organizations and consumers in Russia. (Citation: Secure List Bad Rabbit)(Citation: ESET Bad Rabbit)(Citation: Dragos Apr 2019)

Labels

malware
16 recorded

Relationships

uses
to Bypass User Account Control
Technique
uses
to Data Encrypted for Impact
Technique
uses
to Drive-by Compromise
Technique
uses
to Exploitation of Remote Services
Technique
uses
to Firmware Corruption
Technique
uses
to LSASS Memory
Technique
uses
to Malicious File
Technique
uses
to Match Legitimate Resource Name or Location
Technique
uses
to Native API
Technique
uses
to Network Share Discovery
Technique
uses
to Password Spraying
Technique
uses
to Process Discovery
Technique
uses
to Rundll32
Technique
uses
to Scheduled Task
Technique
uses
to Service Execution
Technique
uses
from Sandworm Team
Group
4 external

References

mitre-attack
S0606
open
Dragos Apr 2019
https://dragos.com/blog/industry-news/implications-of-it-ransomware-for-ics-environments/
open
ESET Bad Rabbit
https://www.welivesecurity.com/2017/10/24/bad-rabbit-not-petya-back/
open
Secure List Bad Rabbit
https://securelist.com/bad-rabbit-ransomware/82851/
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance