BERT Ransomware Group Targets Asia and Europe on Multiple Platforms

A newly emerged ransomware group called BERT has been targeting organizations across Asia and Europe since April. The group employs simple code with effective execution, impacting sectors such as healthcare, technology, and event services. BERT's ransomware operates on both Windows and Linux platforms, using PowerShell-based loaders, privilege escalation, and concurrent file encryption. On Linux systems, it can support up to 50 threads for fast encryption and forcibly shut down ESXi virtual machines. The group's tactics include disabling security features, terminating specific processes, and using standard encryption algorithms. BERT's variants have evolved, streamlining their encryption process and expanding their targeting activities. The Linux variant shows similarities to the REvil ransomware, suggesting possible code reuse.

• PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP FlawsExploitedVulnerability2026-10-21
• Cybersecurity in Christopher Nolan’s The Odyssey | Kaspersky official blogAnalysis2026-10-26
• NanaZip 6.5 · DoSMediumVulnerability2026-08-18
• Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257ExploitedVulnerability2026-10-20
• Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooksHighVulnerability2026-10-23