Threat Intelligence Report June 3 - June 9 2025

Bert Ransomware

Bert is a double-extortion “Data Broker” ransomware family first observed in April 2025: after breaching a Windows host it encrypts data, appends “.encryptedbybert” (or a six-hex variant) to each filename, and plants a ransom note named “.note.txt” that directs victims to negotiate over the privacy-centric Session messenger. The note also threatens to release exfiltrated files on Bert’s Tor leak portal. Technical analyses show the malware uses native Win32 APIs, adds HKLM Run keys for persistence, injects into benign processes, timestomps PE headers to 2007, deletes Volume Shadow Copies, and employs ChaCha20 + Curve25519 for encryption. Initial access in early campaigns has come from phishing e-mails and at least one trojanised software-update distribution, underscoring Bert’s blend of low-friction delivery and aggressive data-leak extortion

TTP Summary

• Initial Access: phishing attachments/links and credential misuse remain the only publicly documented vectors.
• Execution & Persistence: binaries execute via native Win32 APIs or GLIBC calls and install Run-key/Startup entries that survive Safe-Mode boots.
• Privilege Escalation/Defence Evasion: process-injection into explorer.exe/WerFault.exe, timestomping, obfuscated strings, and path masquerading observed in JoeSandbox runs.
• Discovery & Collection: enumerates drives, mapped shares, and browser artefacts before staging data for exfil.
• C2 & Impact: encrypts with ChaCha20 + Curve25519 and communicates with Tor (.onion) services for negotiation.
   

TTP Chart

IOC

# MD5s

# IPs

# Domains / URLs

# Onion services

Leak Site

bertblogsoqmm4ow7nqyh5ik7etsmefdbf25stauecytvwy7tkgizhad.onion

Negotiation Site

File Server

Session ID: 05149ef8a65c342bc76bad335ad3a314ec1321b18cdb6092667083b4e56a4dcb42

Mitigation (Guidance with subtle CE 5.0 context)

• Block Tor & Onion Domains: Add all BERT onion addresses and Tor relay 185.100.157.74 to DNS / web-proxy deny lists. CE 5.0’s Advanced Firewall lets administrators create object-based rules tied to these indicators without touching core routing tables.
• Registry & Safe-Boot Monitoring: Detect unexpected HKLM\…\Run keys or Safe-Mode boots—early signs of BERT’s persistence. CE 5.0’s Intrusion Protection & Detection profile can be bound to the workstation VLAN to raise SOC tickets automatically when such events occur.
• Driver & Script Control: Enforce Microsoft’s vulnerable-driver block list and Attack-Surface-Reduction rules. Where CE is deployed as a gateway, its Network Detection & Response module surfaces BYOVD or process-injection traffic anomalies before encryption starts.
• Immutable Backups & Segmentation: Keep offline/WORM snapshots and separate backup networks; CE’s interface zoning and VLAN support make micro-segmentation straightforward.
• Endpoint Integration: Pair CE with Microsoft Defender for Endpoint to stream ransomware telemetry into the same dashboard, improving mean-time-to-detect without extra consoles.
• Threat-Hunt & Incident Response: Use CE’s built-in Threat Hunt Dashboard for continuous correlation and enable the Incident Response Services plug-in so that critical BERT alerts auto-escalate to Red Piranha’s SOC for 24×7 containment. See here for details.
• Unified Platform Advantage: Because CE 5.0 delivers firewall, IDPS, NDR, DLP and MDR in one appliance, defenders avoid the integration gaps BERT exploits—while keeping licensing overhead low.cyberdefensemagazine.com

Ransomware Victims Worldwide

The United States continues to dominate the global ransomware landscape, accounting for 50.81% of all reported victims this week. Its expansive digital ecosystem, critical infrastructure, and deep enterprise networks make it a primary target for ransomware actors.

Australia emerges as a significant second with 10.48%, reflecting heightened threat actor attention on the Asia-Pacific region—likely due to its growing role in global tech and finance sectors.

Canada reports 7.26%, showing persistent threat activity against North American enterprises. The United Kingdom follows at 4.84%, with continued targeting of financial, legal, and service-based organisations.

Countries like Brazil (3.23%), United Arab Emirates, and Vietnam (2.42% each) represent active zones of exploitation, often tied to strategic industries or emerging markets.

A wide array of nations—including Germany, Venezuela (1.61% each), and Monaco, Barbados, Bahrain, Hungary, Norway, Italy, Ecuador, China, Thailand, Turkey, Colombia, Chile, Jordan, India, Argentina, Croatia, Ireland, and Netherlands (0.81% each)—illustrate the global distribution of ransomware threats. This “long-tail” of impacted countries reinforces the notion that ransomware is a worldwide risk, indiscriminately targeting vulnerable entities regardless of geography.