Cerberos Ransomware

The Cerberos Ransomware is a Trojan that can encrypt your files and create pop-ups with its ransom demands, such as contacting an e-mail address or transferring Bitcoins. Using backups can keep your local media safe from attacks like the Cerberos Ransomware's payload, and following its instructions may not give you a decryptor. Use anti-malware products to delete the Cerberos Ransomware after it attacks your PC or, preferentially, before it finishes installing itself.

Put-Down Hounds Growing New Heads for Barking

While the Cerber Ransomware is, without a doubt, the most publicized reference in the threat industry to Greek mythology's Cerberus, some other threat actors appear interested in taking the name. The same group responsible for the CyberSplitter Vbs Ransomware has modernized their attacks with a new Trojan, the Cerberos Ransomware. In spite of the similar brand names between the Cerberos Ransomware and the infamous Cerber Ransomware, malware analysts are determining that the two file-encrypting Trojans share no significant code in common.

However, the Cerberos Ransomware still does deploy harmful encryption as its most important feature. After enumerating your local drives and searching for files such as Word documents or BMP images, the Cerberos Ransomware encrypts and locks them. Symptoms you also may identify afterward include:

• The Cerberos Ransomware may make changes to the filenames of any encoded content, including removing an old extension or adding a new one.
• The desktop's wallpaper image may be hijacked and reset to one of the Cerberos Ransomware's choice

The Cerberos Ransomware completes its attack with a pop-up window recommending that you contact the threat actor's e-mail address for help. For nearly every file-encrypting Trojan attack, malware experts connect such communications with delayed ransom negotiations. Would-be extortionists may claim, either legitimately or falsely, to give you a decryptor download link or key, which they sell after a transferal of a non-refundable currency such as Bitcoin.

Ensuring that an Underworld Dog's Profits Stay Buried

The Cerberos Ransomware represents an odd change in direction for the ransom-collecting operations of its authors. Although the so-called 'Cyber SpLiTTer Vbs Team' has been using screen-locking pop-ups with built-in paying mechanisms for their previous Trojans, the Cerberos Ransomware reverts to nothing more than providing a Gmail account for the victim to contact. This obfuscated means of ransoming a victim's files could indicate that the threat actors want to negotiate a currency without having examples from past attacks for open comparison.

Whether their motives for the change are straightforward or not, the Cerberos Ransomware can endanger any files on your computer through attacks that may not be reversible. PC users with concerns about the potential lack of a decryption tool should protect their drives by backing them up to either a local storage device or a password-protected server. As of their last analyses, malware experts find that the Cerberos Ransomware displays poor self-defense against its detection and removal by any standard anti-malware program.

As new solutions come out for de-fanging old Trojans, threat actors have to continue developing updates or new products for their unwilling 'market.' Readers only can hope that the Cyber Splitter team will keep failing to impress with comparatively low-key efforts like the Cerberos Ransomware.

Technical Details