{"id":12221,"date":"2016-05-27T09:00:02","date_gmt":"2016-05-27T13:00:02","guid":{"rendered":"https:\/\/www.kaspersky.com.au\/blog\/?p=12221"},"modified":"2020-02-27T04:03:35","modified_gmt":"2020-02-26T17:03:35","slug":"cerber-multipurpose-malware","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com.au\/blog\/cerber-multipurpose-malware\/12221\/","title":{"rendered":"Multipurpose malware: Sometimes Trojans come in threes"},"content":{"rendered":"

As if ransomware weren\u2019t bad enough, now it\u2019s metastasizing: not just spreading rapidly but even picking up secondary characteristics. Take Cerber<\/a>, ransomware first spotted in the wild back in February 2016.<\/p>\n

\"Cerber<\/a><\/p>\n

At the time, Cerber was best known for being somewhat spooky \u2014 instead of merely flashing an ominous message at victims, Cerber delivered its ransom \u201cnote\u201d verbally as well. Still, it was a standard modus operandi: Give us money and we\u2019ll give you back your files.<\/p>\n

Second payload<\/h3>\n

Now, Cerber and other Trojans encrypt the data of their victims, and most computer users haven\u2019t a clue how to handle it<\/a>. Sounds like a great diversionary tactic, doesn\u2019t it?<\/p>\n

It seems Cerber distributors agree. Some updated versions of the malware \u2014 which, aided by sophisticated delivery methods, has positively exploded in recent months<\/a> \u2014 arrive with a second payload. The bonus gift in this case is one designed to add your computer to a malicious botnet army.<\/p>\n

Briefly, here is the sequence of events. First, Cerber arrives in the form of an e-mail attachment. Once executed, the virus behaves like any other ransomware, encrypting files and demanding money for their safe return. But then, security researchers are finding, it confirms the computer\u2019s Internet connection and begins using the infected PC for other purposes, such as for a distributed denial-of-service (DDoS) attack or as a spambot.<\/p>\n

\n

#Cerber<\/a> ransomware on the rise, fueled by #Dridex<\/a> botnets via @threatpost<\/a> https:\/\/t.co\/GBEdClImo3<\/a> pic.twitter.com\/cP3ySzx2z8<\/a><\/p>\n

\u2014 Kaspersky (@kaspersky) May 16, 2016<\/a><\/p><\/blockquote>\n