Reddit NetSec

AlienVault OTX General

CVE Database V5

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A newly emerged ransomware group called BERT has been targeting organizations across Asia and Europe since April. The group employs simple code with effective execution, impacting sectors such as healthcare, technology, and event services. BERT's ransomware operates on both Windows and Linux platforms, using PowerShell-based loaders, privilege escalation, and concurrent file encryption. On Linux systems, it can support up to 50 threads for fast encryption and forcibly shut down ESXi virtual machines. The group's tactics include disabling security features, terminating specific processes, and using standard encryption algorithms. BERT's variants have evolved, streamlining their encryption process and expanding their targeting activities. The Linux variant shows similarities to the REvil ransomware, suggesting possible code reuse.

The BERT ransomware group is a recently emerged threat actor active since April 2025, targeting organizations primarily in Asia and Europe. This group employs ransomware variants that affect both Windows and Linux platforms, demonstrating cross-platform capabilities that increase their attack surface. The ransomware uses PowerShell-based loaders on Windows to execute payloads, leveraging privilege escalation techniques to gain higher system rights. Concurrent file encryption is a notable feature, with the Linux variant capable of utilizing up to 50 threads to rapidly encrypt files, significantly reducing the window for detection and response. Additionally, the Linux variant forcibly shuts down ESXi virtual machines, indicating a focus on disrupting virtualized environments, which are common in enterprise data centers. The group disables security features and terminates specific processes to evade detection and hinder remediation efforts. The ransomware uses standard encryption algorithms, which, while effective, suggests a focus on operational efficiency rather than sophisticated cryptographic innovation. The Linux variant shows code similarities to the REvil ransomware, implying possible code reuse or shared development resources, which may provide insights into the group's capabilities and evolution. BERT's tactics include privilege escalation (MITRE ATT&CK T1548.002), disabling security tools (T1562.004, T1562.001), process termination (T1485), and data encryption (T1486), highlighting a multi-faceted approach to maximize impact. The group targets critical sectors such as healthcare, technology, and event services, which are vital to societal functioning and economic stability. The ransomware's evolution includes streamlining encryption processes and expanding targeting activities, indicating an adaptive threat actor capable of refining their tools and tactics over time. Indicators of compromise include multiple file hashes and an IP address (185.100.157.74) hosting payloads, useful for detection and blocking. No known exploits in the wild are reported, but the threat remains active and evolving.

Detailed information about BERT Ransomware Group Targets Asia and Europe on Multiple Platforms. Get real-time updates, technical details, and mitigation strateg

Title	Severity	Type	Source	Date

Threats Tagged 'green lambert - s0690'

Filter Threats

Threats Tagged 'green lambert - s0690'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility