Story image

What makes the Cerber ransomware so agile?

09 May 17

The Cerber ransomware has been one of the most nimble, varied and dominant malware strains on the market — almost neck-and-neck with Locky.

A recent blog from Trend Micro analysed what makes the Cerber ransomware so fluid, and the answers may be more complex than first thought.

According to Trend Micro’s Smart Protection Network, the US takes the brunt of infections, but Japan accounts for 4.63%; Australia for 2.53%; and China for 1.1%.

The blog says that the ransomware variations are evading even machine learning techniques as it stays one step ahead of the security companies trying to catch them.

Cerber has been on the scene for just over a year and made its name by being sold by cybercriminals as ransomware-as-a-service. The creators earn as much as 40% for every ransom paid by the victim.

But the biggest issue is that creators are constantly modifying the ransomware to make it appeal to potential buyers. Trend Micro says that servers morphed the Cerber ransomware every 15 seconds.

Trend Micro explains that spam emails, exploit kits and infections carry the bulk of Cerber ransomware. When a victim clicks a link or opens the message, the program will start background downloads and file encryption. It chooses selected folders and files, primarily those in shared networks and all machine drives.

While the ransomware has been going after Office 365 and other business programs, how do organisations protect themselves?

Trend Micro says that machine learning is a start, but the Cerber ransomware is evading even the most advanced file detection. It does this by breaking up its stages into files and running processes, which means it’s very hard for security products to spot.

Trend Micro says that a proactive, multilayered security approach is a step in the right direction. Security should be monitoring serviceOKs and applications, as well as any unauthorised application requests and permission changes.

Hillstone CTO's 2019 security predictions
Hillstone Networks CTO Tim Liu shares what key developments could be expected in the areas of security compliance, cloud, security, AI and IoT.
Can it be trusted? Huawei’s founder speaks out
Ren Zhengfei spoke candidly in a recent media roundtable about security, 5G, his daughter’s detainment, the USA, and the West’s perception of Huawei.
Oracle Java Card update boosts security for IoT devices
"Java Card 3.1 is very significant to the Internet of Things, bringing interoperability, security and flexibility to a fast-growing market currently lacking high-security and flexible edge security solutions."
Sophos hires ex-McAfee SVP Gavin Struther
After 16 years as the APAC senior vice president and president for McAfee, Struthers is now heading the APJ arm of Sophos.
Half of companies unable to detect IoT device breaches
A Gemalto study also shows that the of blockchain technology to help secure IoT data, services and devices has doubled in a year.
Huawei founder publically denies spying allegations
“After all the evidence is made public, we will rely on the justice system.”
Malware downloader on the rise in Check Point’s latest Threat Index
Organisations continue to be targeted by cryptominers, despite an overall drop in value across all cryptocurrencies in 2018.
IoT breaches: Nearly half of businesses still can’t detect them
The Internet of Thing’s (IoT’s) rapid rise to prominence may have compromised its security, if a new report from Gemalto is anything to go by.