Innovation is important for malware authors to stay ahead of security controls. In the latest product from the creators of Cerber ransomware, for example, developers have added the ability to create new payload variants in real time by using server-side malware factories.

The Growing Threat of Cerber Ransomware

Cerber is growing in popularity among cybercriminals: It now has a 24 percent market share, although it is still trails CryptoWall (41 percent) and Locky (34 percent), Fortinet recently revealed. Cerber has been active in the U.S., where nearly half of the total infections were found. It was also spotted targeting Taiwan, Japan, Australia, Brazil, Canada, Portugal, Spain, Malaysia and Germany.

Invincea discovered a new Cerber ransomware variant that uses a unique trick designed to defeat signature-based solutions. This is the first time researchers have spotted this particular technique being used for ransomware.

The actual attack used an Office document to drop ransomware onto victims’ machines. These documents contain macros that leverage PowerShell. The process results in a fileless infection, which is typical of newer kinds of ransomware.

One Ransomware, Many Hashes

The hash factory attack means that the infected server will morph the Cerber payload to generate unique hashes. This technique allows the malware to avoid detection since the signature will keep changing over time.

It is unknown whether the payloads on the Cerber delivery server were being generated on the server itself or were being generated remotely and uploaded by a script.

This type of attack has been around for several years. But as SecurityWeek noted, the speed associated with Cerber — new signatures were generated every 15 seconds — is relatively new to the scene.

Invincea asserted that it was able to notify the affected enterprise of the attack and mitigate it, but it gave no details of the remediation method. Until organizations know how to defeat this new kind of polymorphic malware, they should do their best to shore up defenses and steer clear of the threats entirely by applying best practices and encouraging better security awareness.

More from

BlackCat (ALPHV) Ransomware Levels Up for Stealth, Speed and Exfiltration

9 min read - This blog was made possible through contributions from Kat Metrick, Kevin Henson, Agnes Ramos-Beauchamp, Thanassis Diogos, Diego Matos Martins and Joseph Spero. BlackCat ransomware, which was among the top ransomware families observed by IBM Security X-Force in 2022, according to the 2023 X-Force Threat Intelligence Index, continues to wreak havoc across organizations globally this year. BlackCat (a.k.a. ALPHV) ransomware affiliates' more recent attacks include targeting organizations in the healthcare, government, education, manufacturing and hospitality sectors. Reportedly, several of these incidents resulted…

9 min read

Now Social Engineering Attackers Have AI. Do You? 

4 min read - Everybody in tech is talking about ChatGPT, the AI-based chatbot from Open AI that writes convincing prose and usable code. The trouble is malicious cyber attackers can use generative AI tools like ChatGPT to craft convincing prose and usable code just like everybody else. How does this powerful new category of tools affect the ability of criminals to launch cyberattacks, including social engineering attacks? When Every Social Engineering Attack Uses Perfect English ChatGPT is a public tool based on a…

4 min read

Despite Tech Layoffs, Cybersecurity Positions are Hiring

4 min read - It’s easy to read today’s headlines and think that now isn’t the best time to look for a job in the tech industry. However, that’s not necessarily true. When you read deeper into the stories and numbers, cybersecurity positions are still very much in demand. Cybersecurity professionals are landing jobs every day, and IT professionals from other roles may be able to transfer their skills into cybersecurity relatively easily. As cybersecurity continues to remain a top business priority, organizations will…

4 min read

How I Got Started: White Hat Hacker

3 min read - White hat hackers serve as a crucial line of cyber defense, working to identify and mitigate potential threats before malicious actors can exploit them. These ethical hackers harness their skills to assess the security of networks and systems, ultimately helping organizations bolster their digital defenses. But what drives someone to pursue a career as a white hat hacker, and how do you get started in leveraging so-called “evil” skills for the greater good?? In this exclusive Q&A, we spoke with…

3 min read