--- title: "BERT Ransomware Rising: Why Businesses Must Isolate, Not Just Respond" description: New BERT ransomware spreads rapidly on Windows & Linux. Time to shift from detect-and-respond to isolation & containment with AppGuard. image: https://prevent-ransomware.com/hubfs/string%20lights.jpeg --- [![CHIPS Cyber Defense Solutions, LLC](https://prevent-ransomware.com/hubfs/chips_blue_logo_higher_res-20210817212617.png) Cyber Defense Solutions, LLC](https://prevent-ransomware.com) ☰ [About](https://prevent-ransomware.com/about) [Solutions](https://prevent-ransomware.com/solutions) [Industries](https://prevent-ransomware.com/industries) [Resources](https://prevent-ransomware.com/resources) [Partner With Us](https://prevent-ransomware.com/meetings/tony-chiappetta/30-minute-initial-meeting) [About](https://prevent-ransomware.com/about) [Solutions](https://prevent-ransomware.com/solutions) [Industries](https://prevent-ransomware.com/industries) [Resources](https://prevent-ransomware.com/resources) [Partner With Us](https://prevent-ransomware.com/meetings/tony-chiappetta/30-minute-initial-meeting) # BERT Ransomware Rising: Why Businesses Must Isolate, Not Just Respond ![Tony Chiappetta](https://prevent-ransomware.com/hubfs/Tony%20LinkedIn.jpg) by [Tony Chiappetta](https://prevent-ransomware.com/blog/author/tony-chiappetta) August 23, 2025 ## A Swift and Simple Threat: The Rise of BERT Ransomware A newly surfaced, fast-moving ransomware group known as **BERT**—also tracked by Trend Micro as *Water Pombero*—is making waves across Asia, Europe, and the United States. Since its discovery in April 2025, this threat actor has targeted critical sectors such as **healthcare**, **technology**, and **event services** [CSO Online](https://www.csoonline.com/article/4019468/trend-micro-flags-bert-a-rapidly-growing-ransomware-threat.html?utm_source=chatgpt.com)[Trend Micro](https://www.trendmicro.com/en_us/research/25/g/bert-ransomware-group-targets-asia-and-europe-on-multiple-platforms.html?utm_source=chatgpt.com). What makes BERT particularly dangerous is not its sophistication, but its **speed, simplicity, and effectiveness**. --- ## How BERT Operates Across Platforms ### On Windows BERT’s Windows variant employs a **straightforward codebase** to match and kill processes essential to servers and databases.. A PowerShell loader (`start.ps1`) carries out an alarming sequence of actions: - Escalates privileges - Disables Windows Defender, the firewall, and UAC - Downloads and executes the `payload.exe` from a remote host (IP tied to Russian-registered ASN 39134) Because the initial access vector remains unclear, the best defense is strong endpoint protection, admin controls, and proactive security measures. ### On Linux and ESXi Systems The Linux variant of BERT cranks up encryption speed using **up to 50 concurrent threads**, enabling rapid file encryption and minimizing detection windows. Even more troubling: BERT can forcibly shut down **ESXi virtual machines**, significantly complicating recovery. --- ## Why Detection Alone Isn’t Enough Experts warn this is a **wake-up call**. Despite its basic tools, BERT is highly effective at exploiting: - Weak passwords - Outdated endpoint protections - Excessive administrative access - Poor monitoring - Unsafe backups Security professionals must be alert to suspicious PowerShell behavior—especially attempts to disable security tools or download remote payloads—and anomalous hypervisor activity like mass VM shutdowns. --- ## The New Ransomware Landscape: Lean, Fast, Devastating BERT is part of a broader trend: ransomware that is **lighter, modular, and speed-optimized**: - **Gunra**, which appends `.encrt` to encrypted files - **Silent Ransom**, which steals data before demanding ransom - **Hybrid threats** like Mamona, blending speed with stealth These trends expose the limits of traditional AV, EDR, and perimeter-based tools. What’s needed now: **containment-first strategies** that limit blast radius and isolate threats quickly. --- ## From “Detect and Respond” to “Isolation and Containment”: Enter AppGuard We’ve seen what BERT and its peers can do. Now, it’s time to shift the security paradigm. **AppGuard**, with its proven 10-year track record, delivers strong endpoint protection by **isolating untrusted behaviors and processes before they can harm your system**—not just detecting threats after they occur. This approach enables businesses to: - Contain threats at first sight - Prevent privilege escalation and payload execution - Safeguard critical systems—even during rapid, concurrent attacks like those seen in Linux/ESXi environments **Stop playing the crazy game. Come over to the App Guard way of doing things.** --- ## Your Next Step: Shield Your Business with AppGuard Cyber threats like BERT prove that speed and simplicity can wreak havoc when defenses rely only on detection and response. It’s time to bolster your security posture with a strategy rooted in **isolation and containment**. **Business owners**, [talk with us at CHIPS today](https://prevent-ransomware.com/getting-started) to discover how AppGuard can safeguard your endpoints from threats like BERT. Let’s move beyond reactive postures to proactive protection. --- **Why This Matters:** BERT’s rapid expansion and ability to disable defenses show that defense-in-depth is no longer optional—it’s urgent. If your protection strategy still leans heavily on “detect and respond,” it’s time to modernize. AppGuard’s isolation-first model offers the real-world resilience your business needs. Like this article? Please share it with others! [![Share on facebook](https://7528309.fs1.hubspotusercontent-na1.net/hub/7528309/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/facebook-color.png?width=24&name=facebook-color.png)](https://www.facebook.com/share.php?u=https%3A%2F%2Fprevent-ransomware.com%2Fblog%2Fbert-ransomware-rising-why-businesses-must-isolate-not-just-respond%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://7528302.fs1.hubspotusercontent-na1.net/hub/7528302/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/linkedin-color.png?width=24&name=linkedin-color.png)](https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fprevent-ransomware.com%2Fblog%2Fbert-ransomware-rising-why-businesses-must-isolate-not-just-respond%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://7528304.fs1.hubspotusercontent-na1.net/hub/7528304/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/twitter-color.png?width=24&name=twitter-color.png)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fprevent-ransomware.com%2Fblog%2Fbert-ransomware-rising-why-businesses-must-isolate-not-just-respond%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fprevent-ransomware.com%2Fblog%2Fbert-ransomware-rising-why-businesses-must-isolate-not-just-respond%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://7528311.fs1.hubspotusercontent-na1.net/hub/7528311/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/email-color.png?width=24&name=email-color.png)](mailto:?subject=Check+out+https%3A%2F%2Fprevent-ransomware.com%2Fblog%2Fbert-ransomware-rising-why-businesses-must-isolate-not-just-respond%3Futm_medium%3Dsocial%26utm_source%3Demail&body=Check+out+https%3A%2F%2Fprevent-ransomware.com%2Fblog%2Fbert-ransomware-rising-why-businesses-must-isolate-not-just-respond%3Futm_medium%3Dsocial%26utm_source%3Demail)   ###### Tags: [AppGuard,](https://prevent-ransomware.com/blog/tag/appguard) [0-day,](https://prevent-ransomware.com/blog/tag/0-day) [Ransomware](https://prevent-ransomware.com/blog/tag/ransomware) ![Tony Chiappetta](https://prevent-ransomware.com/hubfs/Tony%20LinkedIn.jpg) Post by [Tony Chiappetta](https://prevent-ransomware.com/blog/author/tony-chiappetta) August 23, 2025 [![CHIPS Cyber Defense Solutions, LLC](https://prevent-ransomware.com/hubfs/chips_blue_logo_higher_res-20210817212617.png)](https://prevent-ransomware.com) AppGuard Commercial Distributor for the Americas. Mt. Juliet, Tennessee. [Follow us on LinkedIn](https://www.linkedin.com/company/chips-cyber-defense-solutions-llc) #### The Stack - [AppGuard](https://prevent-ransomware.com/AppGuard) - [Zimperium](https://prevent-ransomware.com/Zimperium) - [CyberCloak](https://prevent-ransomware.com/CyberCloak) #### Company - [About Us](https://prevent-ransomware.com/about) - [The MSP 3.0 Story](https://prevent-ransomware.com/MSP3) - [Become a Partner](https://prevent-ransomware.com/meetings/tony-chiappetta/30-minute-initial-meeting) © 2026 CHIPS Cyber Defense Solutions, LLC. All rights reserved. Built for the Best. ```json { "@context" : "http://schema.org/", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Tony Chiappetta", "url" : "https://prevent-ransomware.com/blog/author/tony-chiappetta" }, "dateModified" : "2025-08-23T9:00:00 AM", "datePublished" : "2025-08-23 09:00:00", "description" : "New BERT ransomware spreads rapidly on Windows & Linux. Time to shift from detect-and-respond to isolation & containment with AppGuard.", "headline" : "BERT Ransomware Rising: Why Businesses Must Isolate, Not Just Respond", "image" : { "@type" : "ImageObject", "url" : "https://20916912.fs1.hubspotusercontent-na1.net/hubfs/20916912/string%20lights.jpeg" }, "mainEntityOfPage" : { "@id" : "https://prevent-ransomware.com/blog/bert-ransomware-rising-why-businesses-must-isolate-not-just-respond", "@type" : "WebPage" }, "name" : "BERT Ransomware Rising: Why Businesses Must Isolate, Not Just Respond", "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://prevent-ransomware.com/hubfs/chips_blue_logo_higher_res-20210817212617.png" }, "name" : "CHIPS Cyber Defense Solutions, LLC" } } ``` ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Tony Chiappetta", "url" : "https://prevent-ransomware.com/blog/author/tony-chiappetta" }, "dateModified" : "2025-08-23T09:00:00.830Z", "datePublished" : "2025-08-23T09:00:00.000Z", "headline" : "BERT Ransomware Rising: Why Businesses Must Isolate, Not Just Respond", "image" : [ "https://prevent-ransomware.com/hubfs/string%20lights.jpeg" ], "mainEntityOfPage" : { "@id" : "https://prevent-ransomware.com/blog/bert-ransomware-rising-why-businesses-must-isolate-not-just-respond", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://prevent-ransomware.com/hubfs/CHIPS%20&%3B%20AppGuard%20logos.png" }, "name" : "CHIPS Cyber Defense Solutions, LLC" } } ```