{"id":3898,"date":"2025-07-09T11:56:38","date_gmt":"2025-07-09T11:56:38","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=3898"},"modified":"2025-07-09T11:56:38","modified_gmt":"2025-07-09T11:56:38","slug":"trend-micro-flags-bert-a-rapidly-growing-ransomware-threat","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=3898","title":{"rendered":"Trend Micro flags BERT: A rapidly growing ransomware threat"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

A new threat actor, BERT, has emerged as a fast-moving ransomware group that has rapidly expanded its activity across Asia, Europe, and the US. Discovered in April, BERT is targeting both Windows and Linux systems.<\/p>\n

Tracked by Trend Micro as \u201cWater Pombero,\u201d the group is targeting critical infrastructure sectors such as healthcare, technology, and event services.<\/p>\n

When targeting Windows variants, the BERT ransomware group employs a straightforward code structure using specific strings to match and terminate certain processes. Over the course of the Trend Micro investigation, the company discovered a PowerShell script<\/a> that functions as a loader for the BERT ransomware payload.<\/p>\n

The script escalates privileges, disables Windows Defender, the firewall, and user account control, then downloads and executes the ransomware from the remote IP address 185[.]100[.]157[.]74. However, the exact initial access method remains unclear, Trend Micro said in a blog post.<\/p>\n

On Linux systems, BERT utilizes 50 concurrent threads to maximize encryption speed, allowing it to quickly encrypt files across the system while minimizing the chances of detection or interruption. Most notably, it can shut down ESXi virtual machines, Trend Micro said.<\/p>\n

A wake-up call<\/h2>\n

BERT does not deploy sophisticated code, but the group\u2019s tools and tactics are designed for speed and impact, making them a growing concern for security professionals worldwide.<\/p>\n

\u201cBERT exploits weak passwords, poor endpoint protection, excessive admin access, lack of monitoring, and insecure backups. It disables defenses, moves quickly, and can even target virtual machines, making recovery harder,\u201d said Pareekh Jain, CEO at EIIRTrend & Pareekh Consulting. BERT ransomware is dangerous despite its simplicity because it\u2019s fast, disables security tools and firewalls, and is easy for attackers to use. Its creators constantly improve it, making it harder to detect and stop, he added.<\/p>\n

For CSOs, these tactics should serve as red flags. Even basic scripting and commodity tools can bypass enterprise defenses when combined with precision and configuration weaknesses.<\/p>\n

\u201cSecurity teams should closely monitor PowerShell sessions that attempt to download remote code or disable security tools, as well as any user account control bypass efforts. Activity around ESXi and vCenter logs, particularly bulk virtual machine shutdowns, should raise immediate red flags. Canary files, which can act as tripwires for early detection, are also critical,\u201d said Amit Jaju, senior managing director at Ankura Consulting.<\/p>\n

Jaju suggested that CISOs should enforce Constrained Language Mode for PowerShell, adopt just-in-time admin privileges, monitor hypervisor APIs for unusual behavior, and implement scripted playbooks for rapid containment, ideally within 15 minutes of detection.<\/p>\n

To strengthen defenses, SOC teams and CISOs must also assume breaches will happen and focus on fast detection and response. \u201cDeploy layered security like EDR\/XDR, network segmentation, and strict privilege controls; enforce application allowlisting; maintain isolated, regularly tested backups; patch vulnerabilities promptly; train employees on phishing and threat awareness; and implement proactive threat hunting and incident response drills,\u201d added Jain.<\/p>\n

Low-code, high impact<\/strong><\/h2>\n

BERT is not an isolated development \u2014 it is part of a growing wave of emerging ransomware groups<\/a> that are proving both capable and elusive. In just the last three to four months, cybersecurity researchers have identified multiple new ransomware families that signal a shift toward leaner, low-code, and faster malware operations.<\/p>\n

For instance, Gunra ransomware<\/a>, spotted in April, appends a .encrt extension to encrypted files and drops a ransom note named r3adm3.txt in multiple directories, and has claimed to target healthcare, electronics, and beverage manufacturing sectors.<\/p>\n

Silent ransomware group<\/a>, known for callback phishing emails, masquerading as well-known businesses that offer subscription plans, has changed tactics by stealing sensitive data such as customer records, phone numbers, intellectual property, and internal emails, and only then triggering a ransom demand.<\/p>\n

\u201cCISOs are now contending with two emerging archetypes of ransomware: \u2018loud-lockers\u2019 like the Gunra group that use multithreading and anti-recovery routines to lock down systems instantly, and \u2018quiet siphoners\u2019 like the Silent Ransom group who avoid malware entirely. Groups like Mamona represent a third hybrid\u2014quick but malware-light, often operating offline and deleting traces post-execution,\u201d said Sanchit Vir Gogia, chief analyst and CEO at Greyhound Research.<\/p>\n

Gogia added that this evolution demands layered defences that prioritise blast radius containment, process forensics, and deception-based detection. Legacy AV, EDR, and perimeter tools alone cannot keep pace with this modular, multi-variant model of threat execution.<\/p>\n

More on ransomware:<\/p>\n

The most notorious and damaging ransomware of all time<\/a><\/p>\n

The state of ransomware: Fragmented but still potent despite takedowns<\/a><\/p>\n

Fog ransomware gang abuses employee monitoring tool in unusual multi-stage attack
<\/a><\/p>\n

><\/p><\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

A new threat actor, BERT, has emerged as a fast-moving ransomware group that has rapidly expanded its activity across Asia, Europe, and the US. Discovered in April, BERT is targeting both Windows and Linux systems. Tracked by Trend Micro as \u201cWater Pombero,\u201d the group is targeting critical infrastructure sectors such as healthcare, technology, and event […]<\/p>\n","protected":false},"author":0,"featured_media":3890,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-3898","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/3898"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3898"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/3898\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/3890"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3898"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3898"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3898"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}