June 7, 2016 By Larry Loeb 2 min read

Innovation is important for malware authors to stay ahead of security controls. In the latest product from the creators of Cerber ransomware, for example, developers have added the ability to create new payload variants in real time by using server-side malware factories.

The Growing Threat of Cerber Ransomware

Cerber is growing in popularity among cybercriminals: It now has a 24 percent market share, although it is still trails CryptoWall (41 percent) and Locky (34 percent), Fortinet recently revealed. Cerber has been active in the U.S., where nearly half of the total infections were found. It was also spotted targeting Taiwan, Japan, Australia, Brazil, Canada, Portugal, Spain, Malaysia and Germany.

Invincea discovered a new Cerber ransomware variant that uses a unique trick designed to defeat signature-based solutions. This is the first time researchers have spotted this particular technique being used for ransomware.

The actual attack used an Office document to drop ransomware onto victims’ machines. These documents contain macros that leverage PowerShell. The process results in a fileless infection, which is typical of newer kinds of ransomware.

One Ransomware, Many Hashes

The hash factory attack means that the infected server will morph the Cerber payload to generate unique hashes. This technique allows the malware to avoid detection since the signature will keep changing over time.

It is unknown whether the payloads on the Cerber delivery server were being generated on the server itself or were being generated remotely and uploaded by a script.

This type of attack has been around for several years. But as SecurityWeek noted, the speed associated with Cerber — new signatures were generated every 15 seconds — is relatively new to the scene.

Invincea asserted that it was able to notify the affected enterprise of the attack and mitigate it, but it gave no details of the remediation method. Until organizations know how to defeat this new kind of polymorphic malware, they should do their best to shore up defenses and steer clear of the threats entirely by applying best practices and encouraging better security awareness.

More from

Exploiting GOG Galaxy XPC service for privilege escalation in macOS

7 min read - Being part of the Adversary Services team at IBM, it is important to keep your skills up to date and learn new things constantly. macOS security was one field where I decided to put more effort this year to further improve my exploitation and operation skills in macOS environments. During my research, I decided to try and discover vulnerabilities in software that I had pre-installed on my laptop, which resulted in the discovery of this vulnerability. In this article, I…

Taking the complexity out of identity solutions for hybrid environments

4 min read - For the past two decades, businesses have been making significant investments to consolidate their identity and access management (IAM) platforms and directories to manage user identities in one place. However, the hybrid nature of the cloud has led many to realize that this ultimate goal is a fantasy. Instead, businesses must learn how to consistently and effectively manage user identities across multiple IAM platforms and directories. As cloud migration and digital transformation accelerate at a dizzying pace, enterprises are left…

IBM identifies zero-day vulnerability in Zyxel NAS devices

12 min read - While investigating CVE-2023-27992, a vulnerability affecting Zyxel network-attached storage (NAS) devices, the IBM X-Force uncovered two new flaws, which when used together, allow for pre-authenticated remote code execution. Zyxel NAS devices are typically used by consumers as cloud storage devices for homes or small to medium-sized businesses. When used together, the flaws X-Force discovered allow a remote attacker to execute arbitrary code on the device with superuser permissions and without requiring any credentials. This results in complete control over the…

What cybersecurity pros can learn from first responders

4 min read - Though they may initially seem very different, there are some compelling similarities between cybersecurity professionals and traditional first responders like police and EMTs. After all, in a world where a cyberattack on critical infrastructure could cause untold damage and harm, cyber responders must be ready for anything. But are they actually prepared? Compared to the readiness of traditional first responders, how do cybersecurity professionals in incident response stand up? Let’s dig deeper into whether the same sense of urgency exists…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today