{"id":2670,"date":"2017-10-30T10:15:35","date_gmt":"2017-10-30T16:15:35","guid":{"rendered":"http:\/\/www.the-internet-guy.com\/?p=2670"},"modified":"2017-10-30T10:15:35","modified_gmt":"2017-10-30T16:15:35","slug":"bad-rabbit-ransomware-uses-leaked-eternalromance-nsa-exploit-to-spread","status":"publish","type":"post","link":"https:\/\/www.the-internet-guy.com\/?p=2670","title":{"rendered":"Bad Rabbit Ransomware Uses Leaked &#8216;EternalRomance&#8217; NSA Exploit to Spread"},"content":{"rendered":"<p><a href=\"https:\/\/thehackernews.com\/2017\/10\/bad-rabbit-ransomware.html\"><img decoding=\"async\" class=\"alignnone size-full\" src=\"http:\/\/www.the-internet-guy.com\/wp-content\/uploads\/2017\/10\/bad-rabbit-ransomware-attack.png\" alt=\"\" \/><\/a><\/p>\n<blockquote><p>A new widespread ransomware worm, known as &#8220;<a href=\"https:\/\/thehackernews.com\/2017\/10\/bad-rabbit-ransomware-attack.html\" target=\"_blank\" rel=\"noopener\">Bad Rabbit<\/a>,&#8221; that hit over 200 major organisations, primarily in Russia and Ukraine this week leverages a stolen NSA exploit released by the Shadow Brokers this April to spread across victims&#8217; networks.<\/p>\n<p>Earlier it was reported that this week&#8217;s crypto-ransomware outbreak did not use any National Security Agency-developed exploits, neither\u00a0<a href=\"https:\/\/thehackernews.com\/2017\/04\/window-zero-day-patch.html\" target=\"_blank\" rel=\"noopener\">EternalRomance<\/a>\u00a0nor\u00a0<a href=\"https:\/\/thehackernews.com\/2017\/04\/windows-hacking-tools.html\" target=\"_blank\" rel=\"noopener\">EternalBlue<\/a>, but a recent report from Cisco&#8217;s Talos Security Intelligence revealed that the Bad Rabbit ransomware did use EternalRomance exploit.<\/p>\n<p><a href=\"https:\/\/thehackernews.com\/2017\/06\/petya-ransomware-attack.html\" target=\"_blank\" rel=\"noopener\">NotPetya ransomware<\/a>\u00a0(also known as ExPetr and Nyetya) that infected tens of thousands of systems back in June also leveraged the\u00a0<a href=\"https:\/\/thehackernews.com\/2017\/07\/petya-ransomware-decryption-key.html\" target=\"_blank\" rel=\"noopener\">EternalRomance exploit<\/a>, along with another NSA&#8217;s leaked Windows hacking exploit EternalBlue, which was used in the\u00a0<a href=\"https:\/\/thehackernews.com\/2017\/05\/how-to-wannacry-ransomware.html\" target=\"_blank\" rel=\"noopener\">WannaCry ransomware<\/a>\u00a0outbreak.<\/p><\/blockquote>\n<p>&nbsp;<\/p>\n<p>Read more <a href=\"https:\/\/thehackernews.com\/2017\/10\/bad-rabbit-ransomware.html\">here<\/a>.<\/p>\n<div class=\"pvc_clear\"><\/div>\n<p id=\"pvc_stats_2670\" class=\"pvc_stats all  \" data-element-id=\"2670\" style=\"\"><i class=\"pvc-stats-icon medium\" aria-hidden=\"true\"><svg aria-hidden=\"true\" focusable=\"false\" data-prefix=\"far\" data-icon=\"chart-bar\" role=\"img\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 512 512\" class=\"svg-inline--fa fa-chart-bar fa-w-16 fa-2x\"><path fill=\"currentColor\" d=\"M396.8 352h22.4c6.4 0 12.8-6.4 12.8-12.8V108.8c0-6.4-6.4-12.8-12.8-12.8h-22.4c-6.4 0-12.8 6.4-12.8 12.8v230.4c0 6.4 6.4 12.8 12.8 12.8zm-192 0h22.4c6.4 0 12.8-6.4 12.8-12.8V140.8c0-6.4-6.4-12.8-12.8-12.8h-22.4c-6.4 0-12.8 6.4-12.8 12.8v198.4c0 6.4 6.4 12.8 12.8 12.8zm96 0h22.4c6.4 0 12.8-6.4 12.8-12.8V204.8c0-6.4-6.4-12.8-12.8-12.8h-22.4c-6.4 0-12.8 6.4-12.8 12.8v134.4c0 6.4 6.4 12.8 12.8 12.8zM496 400H48V80c0-8.84-7.16-16-16-16H16C7.16 64 0 71.16 0 80v336c0 17.67 14.33 32 32 32h464c8.84 0 16-7.16 16-16v-16c0-8.84-7.16-16-16-16zm-387.2-48h22.4c6.4 0 12.8-6.4 12.8-12.8v-70.4c0-6.4-6.4-12.8-12.8-12.8h-22.4c-6.4 0-12.8 6.4-12.8 12.8v70.4c0 6.4 6.4 12.8 12.8 12.8z\" class=\"\"><\/path><\/svg><\/i> <img loading=\"lazy\" decoding=\"async\" width=\"16\" height=\"16\" alt=\"Loading\" src=\"https:\/\/www.the-internet-guy.com\/wp-content\/plugins\/page-views-count\/ajax-loader-2x.gif\" border=0 \/><\/p>\n<div class=\"pvc_clear\"><\/div>\n","protected":false},"excerpt":{"rendered":"<p>A new widespread ransomware worm, known as &#8220;Bad Rabbit,&#8221; that hit over 200 major organisations, primarily in Russia and Ukraine this week leverages a stolen NSA exploit released by the Shadow Brokers this April to spread across victims&#8217; networks. Earlier it was reported that this week&#8217;s crypto-ransomware outbreak did not&hellip;<\/p>\n<p class=\"read-more\"><a href=\"https:\/\/www.the-internet-guy.com\/?p=2670\">Read More<\/a><\/p>\n<div class=\"pvc_clear\"><\/div>\n<p id=\"pvc_stats_2670\" class=\"pvc_stats all  \" data-element-id=\"2670\" style=\"\"><i class=\"pvc-stats-icon medium\" aria-hidden=\"true\"><svg aria-hidden=\"true\" focusable=\"false\" data-prefix=\"far\" data-icon=\"chart-bar\" role=\"img\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 512 512\" class=\"svg-inline--fa fa-chart-bar fa-w-16 fa-2x\"><path fill=\"currentColor\" d=\"M396.8 352h22.4c6.4 0 12.8-6.4 12.8-12.8V108.8c0-6.4-6.4-12.8-12.8-12.8h-22.4c-6.4 0-12.8 6.4-12.8 12.8v230.4c0 6.4 6.4 12.8 12.8 12.8zm-192 0h22.4c6.4 0 12.8-6.4 12.8-12.8V140.8c0-6.4-6.4-12.8-12.8-12.8h-22.4c-6.4 0-12.8 6.4-12.8 12.8v198.4c0 6.4 6.4 12.8 12.8 12.8zm96 0h22.4c6.4 0 12.8-6.4 12.8-12.8V204.8c0-6.4-6.4-12.8-12.8-12.8h-22.4c-6.4 0-12.8 6.4-12.8 12.8v134.4c0 6.4 6.4 12.8 12.8 12.8zM496 400H48V80c0-8.84-7.16-16-16-16H16C7.16 64 0 71.16 0 80v336c0 17.67 14.33 32 32 32h464c8.84 0 16-7.16 16-16v-16c0-8.84-7.16-16-16-16zm-387.2-48h22.4c6.4 0 12.8-6.4 12.8-12.8v-70.4c0-6.4-6.4-12.8-12.8-12.8h-22.4c-6.4 0-12.8 6.4-12.8 12.8v70.4c0 6.4 6.4 12.8 12.8 12.8z\" class=\"\"><\/path><\/svg><\/i> <img loading=\"lazy\" decoding=\"async\" width=\"16\" height=\"16\" alt=\"Loading\" src=\"https:\/\/www.the-internet-guy.com\/wp-content\/plugins\/page-views-count\/ajax-loader-2x.gif\" border=0 \/><\/p>\n<div class=\"pvc_clear\"><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[1],"tags":[],"class_list":["post-2670","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"a3_pvc":{"activated":true,"total_views":41,"today_views":0},"jetpack_publicize_connections":[],"jetpack-related-posts":[],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/www.the-internet-guy.com\/index.php?rest_route=\/wp\/v2\/posts\/2670","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.the-internet-guy.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.the-internet-guy.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.the-internet-guy.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.the-internet-guy.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2670"}],"version-history":[{"count":1,"href":"https:\/\/www.the-internet-guy.com\/index.php?rest_route=\/wp\/v2\/posts\/2670\/revisions"}],"predecessor-version":[{"id":2672,"href":"https:\/\/www.the-internet-guy.com\/index.php?rest_route=\/wp\/v2\/posts\/2670\/revisions\/2672"}],"wp:attachment":[{"href":"https:\/\/www.the-internet-guy.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2670"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.the-internet-guy.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2670"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.the-internet-guy.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2670"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}