BERT is a financially motivated ransomware group that first emerged in April 2025, deploying multi-platform ransomware variants compatible with both Windows and Linux systems, including those targeting ESXi virtual machines. The group is distinguished by its blend of a simple codebase with efficient attack execution, allowing for streamlined operations and evasion despite its less complex malware. Assessed with moderate confidence to be of Russian origin due to observed infrastructure, BERT does not utilize a structured negotiation portal, instead conducting victim communications via privacy-focused messaging channels and exclusively demanding Bitcoin payments. The group also utilizes customized ransomware builds rather than readily available malware.

Aliases del actor

Water PomberoAPT COLDWASTRELcrouching yetidragonflyiron libertytg-4192APT FLAXTYPHOONentryshellsparrowdoorxiangoopAPT GOLDENJACKALAPT GORGONAPT IRONTIGERapt-c-39coloredlambertslambertlonghornplexorchrysalishacked notepad++warbirdBackdoorDiplomacyQuarianTurianAPT REDFOXTROTleslieloaderstorm-2077hydra saigashadowsilkABCloaderABCsyncActor240524

Actores similares

apt-irontigeractor · 1apt-coldwastrelactor · 1apt-flaxtyphoonactor · 1apt-goldenjackalactor · 1apt-gorgonactor · 1apt-redfoxtrotactor · 1Longhornapt · 0apt-45actor · 2apt-c-27actor · 2apt-c-01actor · 2

Sectores atacados

URLs nuevas detectadas en IntelTracker