Rabbit Server-Side Ransomware

Rabbit server-side ransomware is a malicious application written in PHP. By interacting with the web shell, the malicious user can cause it to encrypt files on the filesystem within the web server data directory. Currently, other than paying the ransom, there is no known way to decrypt the files that have been encrypted.

Exploitation

Stages

1. The malicious user exploits an attack vector such as outdated software or a misconfigured server to install the web shell.
2. The malicious user interacts with the web shell and allows the attacker to use web shell functions on the compromised webserver.
3. A status is returned from the web shell indicating that its usage has been successful.

Prerequisites

There is an exploitable vulnerability that allows the malicious files to become resident on the victim's system.

Vulnerability Description

Rabbit Ransomware is a malicious application written in PHP. Once the malicious PHP file is uploaded to a web server, it can be accessed and interacted with. By interacting with the web shell, the malicious user can cause it to encrypt files on the filesystem within the web server data directory. Currently, other than paying the ransom, there is no known way to decrypt the files that have been encrypted.

Alert Logic Coverage

Alert Logic® has evaluated its customer base for exposure to the exploit and has developed signatures for mitigating the threat depending on the security service in place.

The Network-Based Intrusion Detection System (IDS) has been updated with the new signatures for this exploit when detected via Alert Logic Threat Manager™. If this signature is detected, an incident is generated in the Alert Logic console.

Recommendations for Mitigation

Upgrade any software to latest versions; particularly any that exhibit file upload vulnerabilities.