Bad Rabbit is a 2017 ransomware worm that combined file encryption with full-disk locking. It does not rename what it encrypts; instead each file's contents end with the added marker encrypted, so file names look unchanged. A note named Readme.txt is written to the root of each drive, and after a forced reboot a modified bootloader shows a red-on-black lock screen announcing the encryption, asking for a personal installation key to be entered on a Tor payment site that demanded 0.05 BTC. The outbreak ran on 24 October 2017, mostly in Russia and Ukraine with smaller numbers elsewhere, spread by drive-by downloads of a fake Adobe Flash installer planted on hacked news sites. Inside networks it moved through SMB using harvested and hard-coded credentials and the EternalRomance exploit. Code and behaviour overlap heavily with NotPetya, but unlike that wiper it keeps decryption technically possible. Researchers found that the disk-encryption component leaves its generated password in memory, giving a narrow chance to recover it before the process exits, and that shadow copies are left intact, so earlier file versions can survive when full-disk encryption did not complete.
Ransom note filenames: Readme.txt
Decryptor: Decryptor availability has not been recorded. Checked 2026-10-28.
Data exfiltration risk: Undocumented — Analyses describe credential harvesting for lateral movement but no theft of file data; the operation predates double extortion.
Systems typically targeted: Windows workstations and servers, including the boot sector
Do this first: If an infected machine is still running and has not rebooted, keep it powered on and capture a memory image so the disk password left in memory by dispci.exe can be sought.
Dealing with an active incident? Our incident response team is available 24/7.
Emergency response: +1 (877) 364-5161