Bad Rabbit
Software · ATTACK:enterprise:S0606
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0606",
"title": "Bad Rabbit",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0606",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--2eaa5319-5e1e-4dd7-bbc4-566fced3964a",
"external_id": "S0606",
"domain": "enterprise",
"created": "2021-02-09T14:35:39.455Z",
"modified": "2025-01-02T19:45:31.402Z",
"version": "1.1",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Dragos Apr 2019",
"url": "https://dragos.com/blog/industry-news/implications-of-it-ransomware-for-ics-environments/"
},
{
"source_name": "ESET Bad Rabbit",
"url": "https://www.welivesecurity.com/2017/10/24/bad-rabbit-not-petya-back/"
},
{
"source_name": "Secure List Bad Rabbit",
"url": "https://securelist.com/bad-rabbit-ransomware/82851/"
}
]
}Explicit source assertions (16)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0606 → uses → ATTACK:enterprise:T1486
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0252fc3f-1bf0-433f-b619-b874137f84f3
Secure List Bad RabbitATTACK:enterprise:S0606 → uses → ATTACK:enterprise:T1110.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0b8b803a-69e3-4da4-bed6-a28de4c964da
Secure List Bad RabbitATTACK:enterprise:G0034 → uses → ATTACK:enterprise:S0606
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--129a4d3f-fa4a-42c3-833e-8f15155b9693
Secureworks IRON VIKINGATTACK:enterprise:S0606 → uses → ATTACK:enterprise:T1495
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2374acc8-5a15-40cb-bafc-d74c5097249b
Secure List Bad RabbitATTACK:enterprise:S0606 → uses → ATTACK:enterprise:T1569.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--341ef3b2-3f92-4ea1-b36f-93fdb1d15816
ATTACK:enterprise:S0606 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--455fed31-0d5c-42cb-9a79-03df7600db52
Secure List Bad RabbitATTACK:enterprise:S0606 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--509a016a-6243-40b1-b1b5-74f6c79ce413
ESET Bad Rabbit · Secure List Bad RabbitATTACK:enterprise:S0606 → uses → ATTACK:enterprise:T1189
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5ac3cb45-2d9c-42da-b35f-8f797c2e1ef8
ESET Bad Rabbit · Secure List Bad RabbitATTACK:enterprise:S0606 → uses → ATTACK:enterprise:T1003.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--62c9428a-c3cf-476e-b125-a6478bc1bfa1
ESET Bad RabbitATTACK:enterprise:S0606 → uses → ATTACK:enterprise:T1548.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--666ef8c1-cc87-4efa-9f35-f9bf1d1317c6
Secure List Bad RabbitATTACK:enterprise:S0606 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--70b27780-b19a-4313-88ea-1038ce0fc386
Secure List Bad RabbitATTACK:enterprise:S0606 → uses → ATTACK:enterprise:T1135
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7431f8d2-32df-4b26-8b17-24f10f861fde
ESET Bad RabbitATTACK:enterprise:S0606 → uses → ATTACK:enterprise:T1210
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--754d1521-2fcf-4511-b7df-af4fffc7d635
Secure List Bad RabbitATTACK:enterprise:S0606 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--849e3f46-81a5-4865-9a14-fbbf67bfd00a
Secure List Bad RabbitATTACK:enterprise:S0606 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9d9e1fc8-7e93-41e3-b648-762f6f6db384
ESET Bad Rabbit · Secure List Bad RabbitATTACK:enterprise:S0606 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b2852e21-c31a-482a-85fd-00d0990ee8ea
ESET Bad Rabbit