BERT Ransomware’s New Target: Linux Systems

The BERT ransomware operation is making waves by adapting to target Linux systems, a strategy that signals an unsettling new chapter for cybersecurity threats. Originally emerging in March 2025 with a focus on Windows, BERT quickly widened its reach by employing advanced weaponized ELF files for Linux, increasing the breadth of potential victims.

Phishing remains BERT’s weapon of choice for infection, using clever social engineering tactics to penetrate systems. The group operates an intricate dark web setup—including negotiation platforms and leak sites—showing a serious commitment to victim exploitation.

This Linux shift strategically opens the door to more victims, notably sectors dependent on Linux servers like manufacturing, logistics, and healthcare. Reports have identified breaches in nations such as the United States, UK, and Malaysia, to name just a few.

Sophistication in Attack Techniques

BERT’s operational prowess is evident in its sophisticated infiltration methods. Using weaponized PowerShell scripts, BERT effectively neutralizes protective measures before launching its encryption assault. With IP addresses like 185.100.157.74, BERT spreads malicious scripts to escalate privileges and disable Windows defenses, paving the way for its full attack sequence.

The Linux variant of BERT borrows heavily from infamous ransomware like Sodinokibi, utilizing multi-layered encryption methods such as AES and RC4. BERT’s reliance on command and control servers based in less stringent cybersecurity jurisdictions highlights the complexity and global nature of this threat.

[End of article]

*Tags: Cybersecurity, Ransomware, BERT, Linux Threats*

Looking to protect your organization against threats like BERT ransomware? Stay informed with the latest cybersecurity insights and solutions from Qsentinel, your trusted partner in digital security.

Ready to take data security seriously?

Discover how Qsentinel can protect your organization against ransomware, enforce true data sovereignty, and stay ahead of the quantum threat. Their purpose-built workspace is designed for exactly that.

👉 Check out Qsentinel now and secure your future.