‘BadRabbit’ ransomware attack hits Russia, Ukraine, Japan

The US Department of Homeland Security issued a warning on the BadRabbit ransomware.

Cyber attacks using malware called “BadRabbit” hit Russia and other nations on Tuesday, affecting Russian Interfax news agency and causing flight delays at Ukraine’s Odessa airport.

An IT researchers shows on a giant screen a computer infected by a ransomware at the LHS (High Security Laboratory) of the INRIA (National Institute for Research in Computer Science and Automation) in Rennes, on November 3, 2016. (AFP File Photo)

While no major outages were reported, the US government issued a warning on the attack, which followed campaigns in May and June that used similar malware and resulted in what some economists estimated are billions of dollars in losses.

The attacks are disturbing because attackers quickly infected critical infrastructure, including transportation operators, indicating it was a “well-coordinated” campaign, said Robert Lipovsky, a researcher with cyber firm ESET.

More than half the victims were in Russia, followed by Ukraine, Bulgaria, Turkey and Japan, according to ESET.

The US Department of Homeland Security issued a warning on the BadRabbit ransomware, a type of virus that locks up infected computers and asks victims to pay a ransom to restore access. It did not identify any US victims but advised the public to refrain from paying ransoms and report any infections to the Federal Bureau of Investigation through the government’s Internet Crime Complaint Center.

Ransomware infections have the potential to halt activity at targeted organizations. The May “WannaCry” ransomware shuttered hospitals, factories and other facilities around the globe for days.

An Odessa airport spokesman said a few flights were delayed because workers had to process passenger data manually. Kiev’s metro system reported a hack on its payment system but said trains were running normally.

Ukraine’s cyber police chief told Reuters the country was “barely affected.”

Russian cyber-security firm Kaspersky Lab said BadRabbit appeared to spread through a mechanism similar to June’s destructive NotPetya virus, which took down many Ukrainian government agencies and businesses. It then spread across corporate networks of multinationals with operations or suppliers in eastern Europe.

Kaspersky said it was investigating to see whether BadRabbit was related to NotPetya.

Ukrainian banking services, which have been hit by previous attacks, were unaffected, according to the nation’s central bank.