June 7, 2016 By Larry Loeb 2 min read

Innovation is important for malware authors to stay ahead of security controls. In the latest product from the creators of Cerber ransomware, for example, developers have added the ability to create new payload variants in real time by using server-side malware factories.

The Growing Threat of Cerber Ransomware

Cerber is growing in popularity among cybercriminals: It now has a 24 percent market share, although it is still trails CryptoWall (41 percent) and Locky (34 percent), Fortinet recently revealed. Cerber has been active in the U.S., where nearly half of the total infections were found. It was also spotted targeting Taiwan, Japan, Australia, Brazil, Canada, Portugal, Spain, Malaysia and Germany.

Invincea discovered a new Cerber ransomware variant that uses a unique trick designed to defeat signature-based solutions. This is the first time researchers have spotted this particular technique being used for ransomware.

The actual attack used an Office document to drop ransomware onto victims’ machines. These documents contain macros that leverage PowerShell. The process results in a fileless infection, which is typical of newer kinds of ransomware.

One Ransomware, Many Hashes

The hash factory attack means that the infected server will morph the Cerber payload to generate unique hashes. This technique allows the malware to avoid detection since the signature will keep changing over time.

It is unknown whether the payloads on the Cerber delivery server were being generated on the server itself or were being generated remotely and uploaded by a script.

This type of attack has been around for several years. But as SecurityWeek noted, the speed associated with Cerber — new signatures were generated every 15 seconds — is relatively new to the scene.

Invincea asserted that it was able to notify the affected enterprise of the attack and mitigate it, but it gave no details of the remediation method. Until organizations know how to defeat this new kind of polymorphic malware, they should do their best to shore up defenses and steer clear of the threats entirely by applying best practices and encouraging better security awareness.

More from

ONCD releases 2024 Report on the Cybersecurity Posture of the U.S.

4 min read - On May 7, the Office of the National Cyber Director (ONCD) released the 2024 Report on the Cybersecurity Posture of the United States. This new document is a report card on how well cyber policy followed the guidelines set by the National Cybersecurity Strategy, introduced in March 2023. Here’s what you need to know about the newly released report. Fundamental shifts in cyber roles Over the past year, the U.S. national cybersecurity posture was driven by the 2023 National Cybersecurity…

CISA wants private industry to publicly commit to Secure by Design

4 min read - The tech industry has the power to protect the world from nation-state threat attacks, cyber crime and those wanting to compromise data and manipulate critical infrastructure. But with this power comes great responsibility, which, to be honest, the tech industry has not been that interested in holding. But at the RSA Conference (RSAC) in San Francisco, the cybersecurity and tech communities took steps to exert some power and take responsibility. They took the Secure by Design pledge, a promise to…

Change Healthcare discloses $22M ransomware payment

3 min read - UnitedHealth Group CEO Andrew Witty found himself answering questions in front of Congress on May 1 regarding the Change Healthcare ransomware attack that occurred in February. During the hearing, he admitted that his organization paid the attacker's ransomware request. It has been reported that the hacker organization BlackCat, also known as ALPHV, received a payment of $22 million via Bitcoin.Even though they made the ransomware payment, Witty shared that Change Healthcare did not get its data back. This is a…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today