CampaignPublished 20 Jun 2025

BERT RANSOMWARE · THE RAVEN FILE

Source AlienVault OTX General

Description

BERT Ransomware, active since March 2025, has expanded its operations to target both Windows and Linux environments. The group uses phishing for initial access and communicates via the dark web and Sessions for negotiations. Victims span multiple countries, primarily affecting service and manufacturing sectors. The Windows variant employs multiple file extensions and RSA encryption, while the Linux version shares code with Sodinokibi/REvil ransomware. A weaponized PowerShell script is used to disable security features before payload execution. The ransomware's infrastructure is linked to a Russian firm, suggesting potential ties to the region.

Impact

For European organizations, the BERT ransomware campaign poses a significant threat, especially to service providers and manufacturing companies, which are critical to the European economy. Successful infections can lead to widespread encryption of sensitive data, causing operational disruption, financial losses due to ransom payments or downtime, and potential regulatory penalties under GDPR for data breaches. The dual targeting of Windows and Linux systems increases the attack surface, affecting diverse IT environments common in European enterprises. The disabling of security tools prior to payload execution reduces the likelihood of early detection and mitigation, increasing the risk of extensive lateral movement and data encryption. Additionally, the ransomware's ties to a Russian-linked infrastructure may raise concerns amid current geopolitical tensions, potentially increasing the likelihood of targeted attacks against strategic European industries. The use of strong RSA encryption and code similarities to Sodinokibi/REvil, known for high-impact attacks, further underscores the threat's severity. The campaign's reliance on phishing also exploits human factors, which remain a persistent vulnerability in many organizations.

Defensive guidance

European organizations should implement a multi-layered defense strategy tailored to the specific tactics of BERT ransomware. First, enhance phishing detection and user awareness training focused on identifying and reporting suspicious emails, emphasizing the risks of executing unknown attachments or links. Deploy advanced email filtering solutions with sandboxing capabilities to detect weaponized PowerShell scripts and other malicious payloads. Harden endpoint security by configuring PowerShell constrained language mode and enabling script block logging to detect and prevent malicious script execution. Regularly update and patch all Windows and Linux systems to reduce vulnerabilities that could be exploited post-initial access. Implement application whitelisting to restrict execution of unauthorized binaries and scripts. Network segmentation should be enforced to limit lateral movement within the environment. Maintain offline, immutable backups of critical data and regularly test restoration procedures to ensure resilience against encryption. Monitor network traffic for connections to known malicious onion domains associated with BERT ransomware and block them at the firewall or proxy level. Employ threat hunting to identify indicators of compromise such as the provided file hashes. Finally, establish an incident response plan that includes coordination with law enforcement and cybersecurity authorities, considering the geopolitical context of the threat.

Indicators of compromise

Domains 2

bertblogsoqmm4ow7nqyh5ik7etsmefdbf25stauecytvwy7tkgizhad.onion
wtwdv3ss4d637dka7iafl7737ucykei7pluzc7is3mgo2vl5nmq7eeid.onion

Hashes 27

003291d904b89142bada57a9db732ae7
00fdc504be1788231aa7b7d2d1335893
29a2cc59a9ebd334103ce146bca38522
38ce06bf89b28ccebf5a78404eb3818e
3e581aad42a2a9e080a4a676de42f015
5cab4fabffeb5903f684c936a90e0b46
71dc9540eb03f2ed4d1b6496b13fe839
d1013bbaa2f151195d563b2b65126fa3
edec051ce461d62fbbd3abf09534b731
0f63b3603bd4bf49bdbb7e1ab9912e3fc88cf9bf

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 21 Jun 2025, 13:08 UTC

MITRE ATT&CK techniques19 from threat tags

Technical details

Indicators of compromise

Domains 2

Hashes 27

Community reviews

Related threats