The developers behind the Cerber ransomware have released their latest creation onto the Interwebs, which is a new ransomware called Alfa, as reported on Bleeping Computer last week.
Cerber is one of the most active and widespread ransomware families today, along with Locky, CryptXXX, and Jigsaw. Security researchers have not cracked its encryption, so it is very strange to see the group creating a new and different version for no apparent reason.
Since Alfa is new to the ransomware scene, security researchers still don't know how this threat spreads, but they are aware that Alfa is associated with the developers of Cerber and that it has very strong encryption that is currently unbreakable.
Just like most ransomware families today, Alfa encrypts user files and adds an extension to the end of the file. You can recognize Alfa ransomware infections by the additional .bin it adds to encrypted files.
The ransomware targets 142 different file types and after the encryption process is complete, it displays text and HTML-based ransom on the user's desktop and beyond.
The ransom note is poorly worded and may need some work. Additionally, the ransom note uses the term “Alpha” instead of Alfa, which is only used on the Tor-based website where users were told to go to decrypt their files.
The name Alfa ransomware will most likely be used in future versions because there was already an Alpha ransomware that appeared in early May 2016, for which security researchers created a free decrypter.
Cerber's developers will likely want to distance themselves from the term "Alpha ransomware" as much as possible, as they may not want victims to think they can recover their files after a Google for the ransomware's name. Alfa demands 1 Bitcoin (~$650) from each infected user.
