Merge pull request #101 from Delta-Sierra/master

add BadRabbit ransomware

clusters/ransomware.json

@@ -8568,12 +8568,25 @@
           "readme.png"
         ]
       }
+    },
+    {
+      "value": "Bad Rabbit",
+      "description": "On October 24, 2017, Cisco Talos was alerted to a widescale ransomware campaign affecting organizations across eastern Europe and Russia. As was the case in previous situations, we quickly mobilized to assess the situation and ensure that customers remain protected from this and other threats as they emerge across the threat landscape. There have been several large scale ransomware campaigns over the last several months. This appears to have some similarities to Nyetya in that it is also based on Petya ransomware. Major portions of the code appear to have been rewritten. The distribution does not appear to have the sophistication of the supply chain attacks we have seen recently.",
+      "meta": {
+        "refs": [
+          "http://blog.talosintelligence.com/2017/10/bad-rabbit.html"
+        ],
+        "synonyms": [
+          "BadRabbit",
+          "Bad-Rabbit"
+        ]
+      }
     }
   ],
   "source": "Various",
   "uuid": "10cf658b-5d32-4c4b-bb32-61760a640372",
   "name": "Ransomware",
-  "version": 2,
+  "version": 3,
   "type": "ransomware",
   "description": "Ransomware galaxy based on https://docs.google.com/spreadsheets/d/1TWS238xacAto-fLKh1n5uTsdijWdCEsGIM0Y0Hvmc5g/pubhtml and http://pastebin.com/raw/GHgpWjar"
 }