Threat reportRansomwareTL-2026-4008
Tibbar (Bad Rabbit) ransomware alerts triggered by inbound SMTP (TCP/25) SYN connection attempts from 185.149.120.3 on internet-exposed servers
Tibbar (Bad Rabbit) ransomware alerts triggered by inbound (TL-2026-4008), also tracked as Bad Rabbit, is a medium-severity ransomware operation, first published 2026-10-21. It has no confirmed attribution, affects Microsoft Windows Server (internet-exposed hosts onboarded to, maps to 11 MITRE ATT&CK techniques (T1003.001, T1021.002, T1036), and is covered by 9 detection rules and 16 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 11MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 16Indicators of compromise
Key facts for TL-2026-4008
- Threat ID
- TL-2026-4008
- Also known as
- Bad Rabbit, Ransom:Win32/Tibbar.A, Win32/Diskcoder.D
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, enterprise
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 16
Malware and tooling in Tibbar (Bad Rabbit) ransomware alerts triggered by inbound
Malware and tooling: Bad Rabbit - S0606, Mamba, MimiKatz, Tibbar, DiskCryptor, Mimikatz
How Tibbar (Bad Rabbit) ransomware alerts triggered by inbound works
Two customers received high-severity 'Ransomware' alerts from Microsoft Defender for Endpoint (malware family Tibbar). Timeline analysis showed the alerts were raised by inbound TCP SYN ConnectionAttempt events from 185.149.120.3 to port 25 on internet-exposed servers, not by a successful intrusion or ransomware execution.
On 2025-01-17 two customers of DFIR practitioner Stephan Berger (dfir.ch) received high-severity alerts from Microsoft Defender for Endpoint (MDE) categorised as ransomware, naming the malware family Tibbar. The alert GUI showed little context. Pivoting into the device timeline and advanced hunting data showed that the triggering telemetry was a single class of network event: inbound TCP ConnectionAttempt events (TCP flags value 2 = SYN, 60-byte packets, source port 58509) from 185.149.120.3 to destination port 25 (SMTP). Microsoft classifies 185.149.120.3 as malicious. The first affected device (pseudonymised 'malmoeb-one') and a second device ('malmoeb-two', a mail server) were both reachable from the internet, contrary to the customers' assumption.
The source documents no payload delivery, no authenticated session, no file or process activity and no confirmed compromise: the activity is internet-wide style connection probing against an exposed SMTP service that Defender nevertheless mapped to a ransomware alert. The source does not explain why the IP is associated with Tibbar, and no public source reviewed links 185.149.120.3 to Tibbar/Bad Rabbit infection activity, so the association is treated as a Microsoft threat-intelligence reputation match, not an observed infection. No attribution is stated.
Tibbar is Microsoft's detection name (Ransom:Win32/Tibbar.A) for Bad Rabbit (ESET Win32/Diskcoder.D, Symantec Ransom.BadRabbit, Trend Micro Ransom_BADRABBIT.A), first described 2017-10-24. Per Microsoft and Malwarebytes the family arrives via compromised websites as a fake Adobe Flash Player update (Cisco Talos reported the dropper at 1dnscontrol.com/flash_install.php), drops infpub.dat, cscc.dat and dispci.exe, runs via rundll32, creates scheduled tasks named drogon and rhaegal, clears event logs, overwrites the MBR using a DiskCryptor driver, targets 127+ file extensions, spreads over SMB and WMIC using hardcoded credential lists (19 usernames, 35 passwords) and a Mimikatz-based module, and was reported by Malwarebytes to use EternalRomance. These family behaviours are background reference, not behaviours observed in the January 2025 alerts.
Detection engineering takeaway from the source: do not triage by alert title alone. Review the device timeline, identify the triggering ActionType (e.g. ConnectionAttempt, InboundConnectionAccepted, InboundInternetScanInspected), confirm whether the host is internet-facing (DeviceInfo IsInternetFacing; Defender flags devices via external scans and inbound external connections), and validate firewall exposure for services such as SMTP.
MITRE ATT&CK techniques used in TL-2026-4008
Credential Access
T1003.001 OS Credential Dumping: LSASS Memory; T1110.001 Brute Force: Password Guessing
Lateral Movement
T1021.002 Remote Services: SMB/Windows Admin Shares
Defense Evasion
Execution
T1047 Windows Management Instrumentation; T1204.002 User Execution: Malicious File
Persistence
T1053.005 Scheduled Task/Job: Scheduled Task; T1542.003 Pre-OS Boot: Bootkit
Impact
T1561.002 Disk Wipe: Disk Structure Wipe
Reconnaissance
defense-impairment
Affected products and versions in Tibbar (Bad Rabbit) ransomware alerts triggered by inbound
- Microsoft — Windows Server (internet-exposed hosts onboarded to Microsoft Defender for Endpoint, incl. mail server exposing TCP/25)
Remediation for Tibbar (Bad Rabbit) ransomware alerts triggered by inbound
Immediate actions
- Review the Defender device timeline for the triggering ActionType before treating a ransomware-labelled alert as an infection
- Confirm whether the alerting host is internet-facing and whether TCP/25 exposure is intended
- Check DeviceNetworkEvents for any InboundConnectionAccepted events from 185.149.120.3 and for process or file activity following the connection attempts
- Block 185.149.120.3 at the perimeter if no business need exists
Workarounds
- Apply host or network firewall rules limiting TCP/25 to known mail relays
- Tune alert triage so connection-attempt-only ransomware alerts are escalated for exposure review rather than incident response
Longer-term hardening
- Restrict inbound SMTP to designated mail gateways and remove unintended internet exposure of servers
- Hunt periodically for IsInternetFacing devices and InboundInternetScanInspected events to map external attack surface
- Document alert-triage runbooks that require timeline analysis beyond the alert GUI summary
Timeline of Tibbar (Bad Rabbit) ransomware alerts triggered by inbound
- Bad Rabbit (Microsoft detection name Ransom:Win32/Tibbar.A) emerges as a fake Adobe Flash Player drive-by ransomware campaign; Microsoft publishes its encyclopedia entry the same day.
- Microsoft updates its Ransom:Win32/Tibbar.A description (persistence tasks drogon/rhaegal, MBR overwrite, credential brute-forcing).
- Timeline analysis shows the second customer's server, believed not to be internet-exposed, was in fact reachable from the internet on TCP/25; Microsoft's malicious-IP classification of 185.149.120.3 alone was enough to raise the alert, with no accepted connection (ActionType ConnectionAttempt, not InboundConnectionAccepted).
- At 14:56:35 UTC a second customer's server (malmoeb-one) receives the same Tibbar alert from the same source IP and port (58509 to 25), again a TCP SYN ConnectionAttempt.
- At 13:21:38 UTC a customer mail server (malmoeb-two), intentionally internet-exposed, receives a high-severity Defender for Endpoint ransomware (Tibbar) alert; trigger is an inbound TCP SYN ConnectionAttempt (60 bytes) from 185.149.120.3:58509 to port 25.
- dfir.ch publishes analysis showing the alerts stem from connection attempts only, with no confirmed intrusion, and stresses device-timeline analysis beyond the alert GUI.
Sources cited for Tibbar (Bad Rabbit) ransomware alerts triggered by inbound
- Oh my .. ! - Suspicious network traffic detected including Ransomware (Stephan Berger)
- Microsoft Security Intelligence: Ransom:Win32/Tibbar.A
- Microsoft Learn: Investigate devices / internet-facing devices in Defender for Endpoint
- Malwarebytes: BadRabbit - a closer look at the new version of Petya/NotPetya
- The Hacker News: Bad Rabbit ransomware attack
- LogRhythm: Bad Rabbit ransomware technical analysis
- Microsoft Learn: Advanced hunting DeviceNetworkEvents table
Detection coverage for TL-2026-4008
As of 2026-10-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4008 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.