Malware News New Cerber Ransomware v4.0 Sold Online

[BoraMurdar]

There's always something happening in "Ransomwareland" and the latest update we have from this area of the cyber-crime underground is related to the highly-efficient and hugely popular Cerber ransomware, which recently received a major update with the release of v4.0.

Right there with Locky and CryptXXX, Cerber is one of today's most active ransomware threats, with constant updates aimed at changing the ransomware's signature and mode of operation in order to allow it to pass undetected by security software as much as possible.

Cerber has received major updates for the past three months
Released at the start of 2016, Cerber has spent a lot of time at v1.0, with small updates here and there, but never something major.

Something change behind the scenes this summer, in August, an event after which the ransomware has received major updates at the beginning of each month.

Crooks released Cerber v2.0 at the start of August, then Cerber v3.0 at the start of September, and now they've released Cerber v4.0, which according to security researcher Kafeine, they're selling online as part of a rentable Ransomware-as-a-Service platform.

Cerber v4.0 available online as a RaaS service
The ads, written in Russian, and available at the end of this article, provide a series of clues of what's new in Cerber v4.0.

Kafeine says he spotted the ads on October 1, at the same time new Cerber versions started appearing on his radar.

Three days later, other security researchers also noted the launch of this new version, who among other things, featured a new ransom note, new Tor payment URLs, the usage of a random file extension instead of the previous .CERBER3, and a focus on shutting down database processes so it could steal DB data.

Cerber v4.0 distributed via three major malvertising campaigns
According to Trend Micro, Cerber v4.0 is already infecting users, being distributed via at least three major malvertising campaigns.

The first campaign originates from the Magnitude exploit kit, which is a private exploit kit deployed by one gang. There is no surprise seeing Magnitude push Cerber v4 before everyone else, since the Magnitude gang has been one of Cerber's early adopters, and have been pushing only Cerber and no other ransomware, ever since Cerber first came out.

The second malvertising campaign is tracked as PseudoDarkleech, and before switching to Cerber v4.0, these crooks distributed the CrypMIC and CryptXXX ransomware families for months. This group currently uses the RIG exploit kit, after previously dropping the Neutrino exploit kit.

But Neutrino is not dead and appears to have gone private, just like Magnitude. According to Trend Micro, Neutrino is behind a smaller malvertising campaign who is also pushing Cerber v4.0.

To fend off ransomware infections, Trend Micro has probably one of the best advice we've seen anywhere.

“ Ransomware is an evolving threat, and the most fundamental defense is having proper backup processes in place. Follow the 3-2-1 rule: 3 copies, 2 devices, and 1 stored in a secure location. Data loss is manageable as long as regular backups are maintained. ”

 

[Exterminator]

There's always something happening in "Ransomwareland" and the latest update we have from this area of the cyber-crime underground is related to the highly-efficient and hugely popular Cerber ransomware, which recently received a major update with the release of v4.0.

Right there with Locky and CryptXXX, Cerber is one of today's most active ransomware threats, with constant updates aimed at changing the ransomware's signature and mode of operation in order to allow it to pass undetected by security software as much as possible.

Cerber has received major updates for the past three months
Released at the start of 2016, Cerber has spent a lot of time at v1.0, with small updates here and there, but never something major.

Something change behind the scenes this summer, in August, an event after which the ransomware has received major updates at the beginning of each month.

Crooks released Cerber v2.0 at the start of August, then Cerber v3.0 at the start of September, and now they've released Cerber v4.0, which according to security researcher Kafeine, they're selling online as part of a rentable Ransomware-as-a-Service platform.

Cerber v4.0 available online as a RaaS service
The ads, written in Russian, and available at the end of this article, provide a series of clues of what's new in Cerber v4.0.

Kafeine says he spotted the ads on October 1, at the same time new Cerber versions started appearing on his radar.

Three days later, other security researchers also noted the launch of this new version, who among other things, featured a new ransom note, new Tor payment URLs, the usage of a random file extension instead of the previous .CERBER3, and a focus on shutting down database processes so it could steal DB data.

Cerber v4.0 distributed via three major malvertising campaigns
According to Trend Micro, Cerber v4.0 is already infecting users, being distributed via at least three major malvertising campaigns.

The first campaign originates from the Magnitude exploit kit, which is a private exploit kit deployed by one gang. There is no surprise seeing Magnitude push Cerber v4 before everyone else, since the Magnitude gang has been one of Cerber's early adopters, and have been pushing only Cerber and no other ransomware, ever since Cerber first came out.

The second malvertising campaign is tracked as PseudoDarkleech, and before switching to Cerber v4.0, these crooks distributed the CrypMIC and CryptXXX ransomware families for months. This group currently uses the RIG exploit kit, after previously dropping the Neutrino exploit kit.

But Neutrino is not dead and appears to have gone private, just like Magnitude. According to Trend Micro, Neutrino is behind a smaller malvertising campaign who is also pushing Cerber v4.0.

To fend off ransomware infections, Trend Micro has probably one of the best advice we've seen anywhere.

“ Ransomware is an evolving threat, and the most fundamental defense is having proper backup processes in place. Follow the 3-2-1 rule: 3 copies, 2 devices, and 1 stored in a secure location. Data loss is manageable as long as regular backups are maintained. ”

 

[Der.Reisende]

Great share, thank you very much @BoraMurdar! I'm eager to test one out - on a Shadow Defender protected session of my test system.

 

[Solarquest]

Great share@BoraMurdar! I hope @cruelsister can find it and test it against some anti-ransom/AV.
If we find it first, we'll test it in the Hub!

 

[Mr.X]

Great share, thank you very much @BoraMurdar! I'm eager to test one out - on a Shadow Defender protected session of my test system.

Me too!
Someone in possession of a sample could you pm or post somewhere please?

 

[Der.Reisende]

Me too!
Someone in possession of a sample could you pm or post somewhere please?

There was one on HybridAnalysis today, but unfortunately, the uploader did not make it public.

 

[ZeroDay]

Great share, thank you. I'd be interested in testing this too if anyone does have it.

 

[Mr.X]

So no news on how to get a sample?

 

[Der.Reisende]

So no news on how to get a sample?

Haven't come across one now, either wait for the next pack at the Vault where it's likely one can come across or have a look at Hybrid Analysis, there is an option to search for the names of samples, too. In any case, you need an account to download in case the sample is not set private.