Innovation is important for malware authors to stay ahead of security controls. In the latest product from the creators of Cerber ransomware, for example, developers have added the ability to create new payload variants in real time by using server-side malware factories.

The Growing Threat of Cerber Ransomware

Cerber is growing in popularity among cybercriminals: It now has a 24 percent market share, although it is still trails CryptoWall (41 percent) and Locky (34 percent), Fortinet recently revealed. Cerber has been active in the U.S., where nearly half of the total infections were found. It was also spotted targeting Taiwan, Japan, Australia, Brazil, Canada, Portugal, Spain, Malaysia and Germany.

Invincea discovered a new Cerber ransomware variant that uses a unique trick designed to defeat signature-based solutions. This is the first time researchers have spotted this particular technique being used for ransomware.

The actual attack used an Office document to drop ransomware onto victims’ machines. These documents contain macros that leverage PowerShell. The process results in a fileless infection, which is typical of newer kinds of ransomware.

One Ransomware, Many Hashes

The hash factory attack means that the infected server will morph the Cerber payload to generate unique hashes. This technique allows the malware to avoid detection since the signature will keep changing over time.

It is unknown whether the payloads on the Cerber delivery server were being generated on the server itself or were being generated remotely and uploaded by a script.

This type of attack has been around for several years. But as SecurityWeek noted, the speed associated with Cerber — new signatures were generated every 15 seconds — is relatively new to the scene.

Invincea asserted that it was able to notify the affected enterprise of the attack and mitigate it, but it gave no details of the remediation method. Until organizations know how to defeat this new kind of polymorphic malware, they should do their best to shore up defenses and steer clear of the threats entirely by applying best practices and encouraging better security awareness.