BERT Ransomware (Water Pombero) Dissection

Background and Attribution

Trend Micro tracks the BERT ransomware campaign under the threat group name Water Pombero. The campaign began activity in April 2025 and has since expanded across multiple regions, targeting sectors including technology, healthcare, and event services. BERT distinguishes itself from other ransomware groups by offering cross-platform support and maintaining active development of both Windows and Linux payloads.

The codename “Water Pombero” aligns with Trend Micro’s naming convention for tracking threat actor groups and may reference the group’s stealthy, evolving, and regionally diverse characteristics—similar to the folklore character “Pombero” associated with mischief and elusive behavior.

Scope of Attacks

• Geographical Reach: Attacks have been reported in Asia, Europe, and North America.
• Industries Affected: Confirmed victims span various verticals, particularly:
  • Healthcare providers
  • Event management and entertainment services
  • Software and technology companies

These industries are often highly reliant on operational uptime and sensitive data, making them attractive ransomware targets due to the higher likelihood of ransom payment.

Technical Analysis

Windows Variant

• Loader: The ransomware is commonly deployed using PowerShell-based loaders, indicating a fileless or memory-resident approach to evade traditional antivirus detection.
• Process Targeting: Before encryption, it forcibly terminates active processes such as web servers, database services, and other critical applications to ensure access to in-use files.
• Encryption Routine:
  • Uses AES (Advanced Encryption Standard) for file encryption.
  • Applies a multithreaded design for performance.
• Persistence and Execution:
  • While detailed persistence techniques were not shared, attackers likely use scheduled tasks or registry keys based on standard ransomware deployment patterns.

Linux and ESXi Variant

• Multithreading Support: The Linux variant supports up to 50 concurrent threads, allowing it to encrypt files at high speed, which increases impact before detection.
• Virtual Machine Disruption:
  • Targets VMware ESXi environments, which are commonly used in enterprise virtualized data centers.
  • Capable of terminating running virtual machines to encrypt the associated virtual disks (VMDKs), increasing disruption to infrastructure.

This cross-platform capability shows the group’s intention to affect hybrid environments and high-value backend infrastructure, not just endpoint devices.

Evolution and Codebase

Trend Micro notes that earlier BERT samples lacked some of the sophisticated encryption features found in more recent versions. This reflects active development by the group, possibly indicating:

• Ongoing investment in refining its malware toolkit.
• A ransomware-as-a-service (RaaS) or affiliate-driven model with version control.

This progression suggests that the BERT group is continuously adapting to bypass defenses and improve performance.

Ransomware Behavior and Objectives

• Primary Objective: Encrypt files and demand cryptocurrency ransom for decryption keys.
• No confirmed data leak site, but the group may follow a double extortion model in the future, as is common in advanced ransomware campaigns.
• Ransom Note: Dropped on affected systems; likely contains a unique victim ID, instructions for payment, and possibly a test decryption offer.

The attackers’ focus on encryption performance and service disruption (e.g., VM termination) reflects an emphasis on maximum operational damage, increasing the chance of ransom payment.

Detection and Response

Trend Micro’s Trend Vision One™ platform includes detection and prevention mechanisms tailored to BERT ransomware. This includes:

• Behavioral detection rules to identify loader activity (e.g., PowerShell abuse).
• Telemetry correlation across systems to detect lateral movement or file encryption activity.
• Threat intelligence feeds with indicators of compromise (IOCs) specific to BERT.
• Custom hunting queries for security analysts to proactively identify signs of compromise.

Organizations using Trend’s ecosystem can also access YARA rules, IOC sets, and response playbooks for this threat.

Mitigation and Defensive Recommendations

To protect against Water Pombero (BERT) ransomware, organizations should implement layered security measures:

1. Backup Strategy:
   • Use offline and immutable backups.
   • Ensure backups are segmented from the main network to avoid encryption during lateral movement.
2. Endpoint Security:
   • Deploy EDR/XDR platforms capable of detecting behavioral anomalies, not just signatures.
   • Monitor for PowerShell abuse and process tampering.
3. Network Security:
   • Limit access to RDP and SSH using VPNs and multifactor authentication (MFA).
   • Use network segmentation to limit the blast radius of lateral movement.
4. Patch Management:
   • Ensure timely updates of both Windows and Linux systems, especially hypervisors like VMware ESXi.
   • Close exposed management interfaces.
5. Incident Response Readiness:
   • Develop ransomware response runbooks.
   • Simulate ransomware incidents regularly for blue teams.
6. User Awareness:
   • Train users to recognize phishing emails and malicious document lures—common entry points for ransomware loaders.

Executive Summary

IOC List

1. File Extensions & Filenames

• Encrypted File Extension:
  .bert (added to all encrypted files)
• Ransom Note Filenames:
  • ReadMe_Important.txt
  • RestoreFiles.txt (variant names may vary by campaign)

2. Registry Keys (Windows)

BERT uses registry entries to establish persistence:

• HKCU\Software\Microsoft\Windows\CurrentVersion\Run\bert_loader
• Potential custom keys under:
  • HKLM\SYSTEM\CurrentControlSet\Services\
  • HKCU\Software\BERT\

3. File Paths / Dropped Files

• PowerShell script loaders may be dropped in:
  • C:\Users\[username]\AppData\Roaming\
  • C:\ProgramData\
• Executables or batch files possibly named:
  • bert.ps1
  • payload.exe
  • vm_killer.bat

4. Network Indicators

C2 (Command and Control) Infrastructure:

• Trend Micro has not published exact C2 domains or IPs, but BERT is known to use:
  • HTTP POST requests to attacker-controlled domains
  • Potential dynamic DNS services or TOR hidden services for communication

Monitor for:

• Unusual outbound connections from PowerShell or unknown binaries
• Connections to uncommon ports (e.g., 4443, 8081)

5. Process and Service Behavior

• Processes Terminated by Ransomware:
  • sqlserver.exe
  • vmware-vmx.exe
  • oracle.exe
  • tomcat.exe
  • nginx.exe
  • httpd.exe
• Processes Spawned:
  • powershell.exe (with encoded or obfuscated command lines)
  • taskkill.exe (used to kill services)
  • vssadmin.exe delete shadows

6. YARA Signature (Example – Generic)

(Note: Sample only – not an official release)rule BERT_Generic_Ransomware { meta: description = "Detects BERT ransomware binaries" author = "Analyst" date = "2025-07-10" strings: $ext = ".bert" $msg1 = "All your files have been encrypted" $note = "ReadMe_Important.txt" condition: any of ($ext, $msg1, $note) }

7. MITRE ATT&CK Techniques (Observed or Likely)

8. Log Artifacts (for DFIR)

• Windows Event Logs:
  • Event ID 7045: New service installation
  • Event ID 4104: PowerShell script block logging (if enabled)
  • Event ID 4688: Process creation (shows suspicious command-line usage)
  • Event ID 4624/4625: Login attempts (may show brute-force prior to ransomware activity)