'Bad Rabbit' Ransomware Strikes Ukraine And Russia

Image copyright AFP

A new strain of ransomware nicknamed "Bad Rabbit" has been found spreading in Russia, Ukraine and elsewhere.

The malware has affected systems at three Russian websites, an airport in Ukraine and an underground railway in the capital city, Kiev.

The cyber-police chief in Ukraine confirmed to the Reuters news agency that Bad Rabbit was the ransomware in question.

It bears similarities to the WannaCry and Petya outbreaks earlier this year.

However, it is not yet known how far this new malware will be able to spread.

"In some of the companies, the work has been completely paralysed - servers and workstations are encrypted," head of Russian cyber-security firm Group-IB, Ilya Sachkov, told the TASS news agency.

Two of the affected sites are Interfax and Fontanka.ru.

Russia hit most

"According to our data, most of the victims targeted by these attacks are located in Russia," said Vyacheslav Zakorzhevsky at Kaspersky Lab.

"We have also seen similar but fewer attacks in Ukraine, Turkey and Germany."

Bad Rabbit encrypts the contents of a computer and asks for a payment - in this case 0.05 bitcoins, or about $280 (£213).

Cyber-security firms, including Russia-based Kaspersky, have said they are monitoring the attack.

The malware is still undetected by the majority of anti-virus programs, according to analysis by virus checking site Virus Total.

One security firm, Eset, has said that the malware was distributed via a bogus Adobe Flash update.

Researcher Kevin Beaumont has posted a screenshot that shows Bad Rabbit creating tasks in Windows named after the dragons Drogon and Rhaegal in TV series Game of Thrones.

The outbreak bears similarities to the WannaCry and Petya ransomware outbreaks that spread around the world causing widespread disruption earlier this year.