Cerber 6 Ransomware

The Cerber 6 Ransomware is a spring 2017 update to the Cerber Ransomware family, providing additional anti-security features and a new, potentially more secure encryption routine. Installation methods for this category of threats focus on e-mail spam attachments, which conceal the Trojan's installer as being a safe content. Back up your files and disregard ransom demands, when possible, to protect your data from this Trojan, and use anti-malware products for removing the Cerber 6 Ransomware whenever it succeeds in infecting your PC.

The Threat Weather Report for Spring

The Cerber Ransomware family still is one of the most profitable ones in the RaaS (or Ransomware-as-a-Service) sub-sector of the threat industry, making it an ongoing threat to anyone who doesn't back their files up to another drive. Various threat actors renting it from its central team are distributing the latest version of this family, the Cerber 6 Ransomware, live. All known infection vectors for the Cerber 6 Ransomware variant utilize e-mail attachments, specifically, compressed ZIP archives.

The Cerber 6 Ransomware doesn't install itself immediately. After the archive's interior executable launches, the loader checks the system for telltale signs of an analysis environment such as a sandbox. For such systems, the Trojan never loads. For others, the Cerber 6 Ransomware is set to run after a two-minute delay (another, new anti-security feature) and start encrypting your local files.

Malware analysts also can verify that the Cerber 6 Ransomware uses a different algorithm for locking your files, with a basis in the CryptoAPI instead of the RSA. The files that the Cerber 6 Ransomware blocks are up to the third-party con artists renting it and the Trojan can differentiate between media due to both the format and the directory location. After taking these files hostage, it drops an HTA extortion message that supports multiple languages, including French, English and Turkish.

Stopping Ready-Baked Trojans from Raining Money onto Their Creators

The Cerber 6 Ransomware's authors have a long history of showing reasonable, basic proficiency in coding threats that are both efficient and profitable. The new implementation of the Cerber 6 Ransomware also is highly expressive of how adjustable their design goals can be, with previous features replaced by new ones serving similar functions, but with lower detection rates by security tools. Although the Cerber 6 Ransomware no longer terminates the memory processes of other programs, it does block outgoing network traffic for some software, particularly ones associated with major anti-malware and security companies.

PC users needing to recover their files by decrypting them should avoid using decryption utilities meant for old versions of the Cerber Ransomware family, which use different algorithms. Because paying ransoms doesn't always result in access to a real decryptor, malware experts recommend using backups for counteracting new threats of this classification, like the Cerber 6 Ransomware. The Trojan may delete local backup content, meaning that backups stored on cloud servers or peripherals are more likely of being safe.

PC users with even bare bones knowledge of the current threat industry will know enough to scan suspicious attachments and delete the Cerber 6 Ransomware before any encryption ever can trigger. For those less informed, their files may be one scheduled task away from being enciphered permanently.

Technical Details