The criminal group behind the Cerber ransomware was extremely busy during early April and late May, according to a recent report from Israeli security firm Check Point.
Cerber is a new ransomware that appeared at the beginning of the year and is believed to be the creation of a Russian team of developers. The ransomware 's hallmark is the use of a TTS (Text-to-Speech) API to read the ransom note to infected users.
Since then, the ransomware has been constantly evolving by adding new features, specifically it appears that an organized group of cybercriminals was behind the ransomware, providing financial and human resources to keep Cerber up to date.
The strange thing about Cerber was that the people behind this malware didn't run permanent operations. The crooks sent out a huge wave of spam for a few days and then usually took a break for a week or more.
Check Point says what it noticed was that the two most recent waves were larger than usual. The first wave took place between April 4-18, while the second took place between May 20-31.
The scammers sent a large number of spam emails containing Office documents with malicious macros that downloaded and installed the ransomware.
This campaign hit US users the hardest, with 41 percent of all targets residing in that country. Users in Turkey followed in second place, followed by the UK, Israel, and Taiwan.
What was most curious was the fact that the second Cerber ransomware spam wave was perfectly overlapped by another massive spam campaign that occurred during the same time period.
ESET and Proofpoint reported a large number of spam emails delivering ZIP files with malicious JS files inside that downloaded and installed Locky ransomware. So far, there is no evidence of a connection between the crooks distributing Locky and Cerber.
