Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

BERT Ransomware, active since March 2025, has expanded its operations to target both Windows and Linux environments. The group uses phishing for initial access and communicates via the dark web and Sessions for negotiations. Victims span multiple countries, primarily affecting service and manufacturing sectors. The Windows variant employs multiple file extensions and RSA encryption, while the Linux version shares code with Sodinokibi/REvil ransomware. A weaponized PowerShell script is used to disable security features before payload execution. The ransomware's infrastructure is linked to a Russian firm, suggesting potential ties to the region.

BERT Ransomware, active since March 2025, represents a sophisticated ransomware campaign targeting both Windows and Linux environments. The threat actors behind BERT employ phishing emails as their primary initial access vector, leveraging social engineering to trick users into executing malicious payloads. Once inside a network, the ransomware uses a weaponized PowerShell script to disable security features such as antivirus and endpoint detection and response (EDR) tools, facilitating unhindered payload execution. The Windows variant of BERT ransomware encrypts victim files using RSA encryption and appends multiple file extensions to encrypted files, complicating recovery efforts. The Linux variant shares significant code overlap with the notorious Sodinokibi/REvil ransomware, indicating possible code reuse or collaboration. Communication and ransom negotiations occur via dark web portals and the Sessions encrypted messaging platform, enhancing the attackers' anonymity and operational security. The ransomware primarily targets organizations in the service and manufacturing sectors across multiple countries. The infrastructure supporting BERT ransomware is linked to a Russian firm, suggesting potential geopolitical motivations or origin. Indicators of compromise include numerous file hashes associated with the ransomware binaries and two onion domains used for command and control or negotiation purposes. Although no known exploits are reported in the wild, the campaign's use of phishing and PowerShell-based disabling of defenses indicates a high level of operational sophistication and adaptability across different operating systems.

Detailed information about BERT RANSOMWARE - THE RAVEN FILE. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'bert ransomware'

Filter Threats

Threats Tagged 'bert ransomware'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility