<\/p>\n
Cerber is one of the most popular ransomware packages. It has upgraded itself to also target databases. It is available for purchase as a service (ransomware as a service) on the “dark net” as part of an affiliate program. Cerber is part of a turnkey service in which clients share 40% of their profits with the developers. In turn, the Cerber team does all the work on the back end to make it simple for their affiliates to distribute the malware and receive payments from victims, minus the overhead costs.<\/p>\n
This update is significant. It expands the capabilities to not only targeted consumers, but now to businesses as well. This shift is the latest trend with the top ransomware families. Attackers have realized that though consumers may pay $300\u2013$500 for their files, businesses will may much more. As most criminals do, they pursue the money.<\/p>\n
The latest version of Cerber has made three important changes. The malware now alters the extensions of encrypted files to a random four characters. Previously it changed the extension of altered files to .cerber3.\u00a0This adaptation makes it more difficult to scan for affected files. (For more on the extensions, read this McAfee Labs blog.)<\/a><\/p>\n Second, a new HTML executable file displays the ransom note and instructions in a window. It is cleaner, provides links, and is more professional looking. This may give victims more confidence that they are dealing with professionals and should expect to receive a key to unlock their files if they pay.<\/p>\n Finally, and most important, the malware now attempts to stop database processes running on the target system so it can encrypt the data. This is a significant shift in focus from consumers to businesses, which typically run databases containing important operational data. When database files are open and in use by software, they cannot easily be encrypted. Cerber attempts to close the database software so the files can be encrypted.<\/p>\n Security experts believe Cerber is based in Russia because it avoids systems configured in the Russian language. But it has the rest of the world to target, and it does well. Estimates vary, but profits appear to range from $1 million to $2.5 million per year. In August, Check Point Software and IntSights tracked 161 campaigns active with eight new ones launched every day. In July, they tracked 150,000 new system infections, with an average extortion demand of one Bitcoin.<\/p>\nBig business\u00a0<\/strong><\/h2>\n
Cerber in action<\/strong><\/h2>\n