BERT Ransomware Disrupts Recovery by Forcing ESXi Virtual Machine Shutdowns

A newly identified ransomware group, tracked by Trend Micro as Water Pombero and known as “BERT” in the threat landscape, has swiftly emerged as a formidable adversary targeting organizations in Asia, Europe, and the United States.

With a focus on healthcare, technology, and event services sectors, BERT’s cross-platform ransomware has successfully compromised both Windows and Linux systems, employing a blend of simplicity and technical sophistication to maximize its disruptive potential.

New Threat Group Targets Critical Sectors Worldwide

Trend Micro’s telemetry first observed BERT’s activity in April, noting its rapid expansion and evolution across multiple incidents.

On Windows systems, the BERT group leverages a PowerShell-based loader (start.ps1) designed to escalate privileges, disable endpoint defenses (such as Windows Defender and the system firewall), and ultimately deploy the ransomware payload from an IP address tied to Russian infrastructure.

The Windows variant features a straightforward codebase, but effectively terminates crucial processes such as web servers and database services before encrypting files with the AES algorithm.

Notably, BERT’s operators are actively refining their toolkit, as evidenced by the emergence of newer samples with improved multi-threaded encryption and real-time file discovery capabilities.

The threat is particularly acute on Linux platforms, where BERT’s ransomware variant stands out for its ability to support up to 50 concurrent threads, substantially increasing the speed and scope of encryption.

In a calculated move to amplify impact, the Linux variant forcibly shuts down ESXi virtual machines via command-line utilities.

This tactic not only disrupts running workloads but also thwarts immediate recovery efforts by encrypting VM snapshots and associated data.

Upon completion, affected files are appended with the extension “.encrypted_by_bert,” and a ransom note is left behind.

Advanced Techniques

The ransomware’s configuration is stored in a JSON format inside the binary, containing essential details such as the encryption public key and ransom note an approach that facilitates effortless adaptation for different campaigns.

Further analysis suggests code-level overlaps with well-known ransomware strains, such as the Linux variant of REvil and elements from Babuk and Conti, highlighting how emerging groups often repurpose established attack frameworks to accelerate development.

Trend Vision One™, Trend Micro’s AI-powered cybersecurity platform, has demonstrated efficacy in detecting and blocking BERT-related indicators of compromise (IOCs).

The platform provides comprehensive threat intelligence, hunting queries, and timely insights, empowering security teams to proactively hunt and mitigate risks in real time.

Given BERT’s reliance on PowerShell loaders and privilege escalation, experts urge organizations to adopt a multilayered defense strategy.

This includes restricting admin rights, closely monitoring for unauthorized script execution, hardening ESXi servers, and regularly updating endpoint security solutions.

Additional recommendations encompass regular employee training, robust data backup regimes, and continuous monitoring for abnormal network and system behavior.

Despite leveraging a relatively simple code structure, the BERT group exemplifies how methodical use of readily available techniques can result in significant operational disruption underscoring the necessity for vigilance, layered defenses, and a rapid incident response capability within all organizations.

Indicators of Compromise (IOCs)

Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant updates