Cerber Ransomware Articulates Its Demands with Voice

A new strain of file-encrypting malware dubbed Cerber proved to be a one-of-a-kind infection. Its uniqueness is all about the use of a VBScript that produces an audio output via the targeted computer’s built-in speakers. The ransomware literally speaks to its victims and instructs them on data recovery options.

This plague circulates on a so-called Ransomware as a Service basis, which implies that wannabe cyber extortionists can obtain the readily available program, launch their own affiliate campaign and then share a certain percentage of their ransom income with the developer.

Cerber operates with some predefined geo-restrictions and doesn’t target users from a number of Eastern European countries, including Belarus and Russia. When executed on a computer, it traverses the hard drive and network shares in order to find popular data formats while ignoring system files. The Trojan makes the user’s personal files inaccessible by encrypting them with AES, a strong symmetric algorithm. It also appends .cerber string to the hostage items and encodes the filenames.

The victims get decryption instructions in a document named # DECRYPT MY FILES #, which comes in HTML, TXT and VBS formats. The latter version is the one that generates voice. The ransom of 1.24 Bitcoins, or around 500 USD, is the prerequisite for file decoding, and it should be submitted during a 7-day period.

Security experts are currently working on a way to get around the encryption, so far to no avail. In the meantime, those who fell victim to Cerber and don’t feel like paying the ransom should try restoring Shadow Copies of their files, use data recovery tools or recover files from backup, if any. Removal and decryption advice can be found here: http://nabzsoftware.com/types-of-threats/cerber-file