# Tibbar (Bad Rabbit) ransomware alerts triggered by inbound SMTP (TCP/25) SYN connection attempts from 185.149.120.3 on internet-exposed servers

> Two customers received high-severity 'Ransomware' alerts from Microsoft Defender for Endpoint (malware family Tibbar). Timeline analysis showed the alerts were raised by inbound TCP SYN ConnectionAttempt events from 185.149.120.3 to port 25 on internet-exposed servers, not by a successful intrusion or ransomware execution.

- **Published:** 2026-10-21T04:12:14Z
- **Last reviewed:** 2026-10-21T04:12:14Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4008
- **ID:** TL-2026-4008
- **Severity:** MEDIUM
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2025-01-17 two customers of DFIR practitioner Stephan Berger (dfir.ch) received high-severity alerts from Microsoft Defender for Endpoint (MDE) categorised as ransomware, naming the malware family Tibbar. The alert GUI showed little context. Pivoting into the device timeline and advanced hunting data showed that the triggering telemetry was a single class of network event: inbound TCP ConnectionAttempt events (TCP flags value 2 = SYN, 60-byte packets, source port 58509) from 185.149.120.3 to destination port 25 (SMTP). Microsoft classifies 185.149.120.3 as malicious. The first affected device (pseudonymised 'malmoeb-one') and a second device ('malmoeb-two', a mail server) were both reachable from the internet, contrary to the customers' assumption.

The source documents no payload delivery, no authenticated session, no file or process activity and no confirmed compromise: the activity is internet-wide style connection probing against an exposed SMTP service that Defender nevertheless mapped to a ransomware alert. The source does not explain why the IP is associated with Tibbar, and no public source reviewed links 185.149.120.3 to Tibbar/Bad Rabbit infection activity, so the association is treated as a Microsoft threat-intelligence reputation match, not an observed infection. No attribution is stated.

Tibbar is Microsoft's detection name (Ransom:Win32/Tibbar.A) for Bad Rabbit (ESET Win32/Diskcoder.D, Symantec Ransom.BadRabbit, Trend Micro Ransom_BADRABBIT.A), first described 2017-10-24. Per Microsoft and Malwarebytes the family arrives via compromised websites as a fake Adobe Flash Player update (Cisco Talos reported the dropper at 1dnscontrol.com/flash_install.php), drops infpub.dat, cscc.dat and dispci.exe, runs via rundll32, creates scheduled tasks named drogon and rhaegal, clears event logs, overwrites the MBR using a DiskCryptor driver, targets 127+ file extensions, spreads over SMB and WMIC using hardcoded credential lists (19 usernames, 35 passwords) and a Mimikatz-based module, and was reported by Malwarebytes to use EternalRomance. These family behaviours are background reference, not behaviours observed in the January 2025 alerts.

Detection engineering takeaway from the source: do not triage by alert title alone. Review the device timeline, identify the triggering ActionType (e.g. ConnectionAttempt, InboundConnectionAccepted, InboundInternetScanInspected), confirm whether the host is internet-facing (DeviceInfo IsInternetFacing; Defender flags devices via external scans and inbound external connections), and validate firewall exposure for services such as SMTP.

## MITRE ATT&CK

- T1595 Active Scanning
- T1204.002 User Execution: Malicious File
- T1047 Windows Management Instrumentation
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1542.003 Pre-OS Boot: Bootkit
- T1685.005 Clear Windows Event Logs
- T1036 Masquerading
- T1110.001 Brute Force: Password Guessing
- T1003.001 OS Credential Dumping: LSASS Memory
- T1021.002 Remote Services: SMB/Windows Admin Shares
- T1561.002 Disk Wipe: Disk Structure Wipe

## Sources

- [Oh my .. ! - Suspicious network traffic detected including Ransomware (Stephan Berger)](https://dfir.ch/posts/suspicious_network_traffic_ransomware/)
- [Microsoft Security Intelligence: Ransom:Win32/Tibbar.A](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Tibbar.A)
- [Microsoft Learn: Investigate devices / internet-facing devices in Defender for Endpoint](https://learn.microsoft.com/en-us/defender-endpoint/internet-facing-devices)
- [Malwarebytes: BadRabbit - a closer look at the new version of Petya/NotPetya](https://www.malwarebytes.com/blog/threat-analysis/2017/10/badrabbit-closer-look-new-version-petyanotpetya/)
- [The Hacker News: Bad Rabbit ransomware attack](https://thehackernews.com/2017/10/bad-rabbit-ransomware-attack.html)
- [LogRhythm: Bad Rabbit ransomware technical analysis](https://logrhythm.com/blog/bad-rabbit-ransomware-technical-analysis/)
- [Microsoft Learn: Advanced hunting DeviceNetworkEvents table](https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-devicenetworkevents-table)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4008