Palo Alto Networks Protections Against Bad Rabbit Ransomware Attacks

What Happened

On Tuesday, October 24, a new variant of ransomware called Bad Rabbit began spreading throughout Eastern Europe. These attacks reportedly impacted multiple organizations in Russia, Ukraine, Turkey, and other countries within the region. Our Next-Generation Security Platform automatically created, delivered and enforced protections from this attack.

Bad Rabbit gains initial entry by posing as an Adobe Flash update. Once inside a network it spreads by harvesting credentials with the Mimikatz tool as well as using hard coded credentials. Bad Rabbit is similar to Petya/NotPetya insofar as it encrypts the entire disk. For a detailed analysis on the Bad Rabbit attack playbook, please see our blog from the Unit 42 threat research team.

Preventions

Palo Alto Networks customers are protected through our Next-Generation Security Platform, which provides prevention through automation, applied consistently across the network, endpoint and cloud. Palo Alto Networks customers are protected from Bad Rabbit ransomware through multiple complementary prevention controls across the platform, including:

• WildFire classifies all known samples as malware, automatically blocking malicious content from being delivered to users.
• AutoFocus tracks the attack for threat analytics and hunting via the Bad Rabbit tag.
• Threat Prevention enforces protections for malicious payloads and DNS activity, including:
  • Antivirus signatures:
    • Unique Threat IDs: 187795407 and 187792728, as well as Trojan/Win32.ransom.pme” and “Trojan-Ransom/Win32.gen.eian” signature names.
  • DNS signatures:
    • Unique Threat ID: 187797549
• URL Filtering blocks all known injection URLs.
• GlobalProtect extends WildFire and Threat Prevention protections to ensure consistent coverage for remote locations and users.
• Traps uses its multi-method approach to prevent the malware from being executed on the endpoint automatically via integrated threat analysis and sharing with WildFire.
• Block Portable Executables (PEs) according to file blocking best practices, preventing malicious payload being delivered to users.
• Multi-Factor Authentication (MFA) can stop the usage of valid credentials, which were potentially leveraged to infect additional systems across the network.

NOTE: We are continuously monitoring the Bad Rabbit situation and will update this post with additional details on protections as they arise.

For best practices on preventing ransomware with the Palo Alto Networks Next-Generation Security Platform, please refer to our Knowledge Base article. We strongly recommend that all Adobe users take additional steps to protect themselves by only getting Adobe Flash updates from the Adobe web site. For the latest on the Bad Rabbit attack playbook, please see the Threat Brief: Information on Bad Rabbit Ransomware Attacks post.

Version Summary

October 24, 2017 2:30 p.m. PT

• Initial Publication

October 25, 2017 11:00 a.m. PT

• Added details on Traps