Cerber Spam: Tor All the Things!
Summary: Cisco Talos reported a Cerber 5.0.1 ransomware spam campaign that began November 24 and used Google redirection plus the Tor2Web proxy domain onion.to to deliver a malicious Word document, which invoked PowerShell to download and run the ransomware executable from the Tor network. The emails carried no attachments, used short subject lines such as "Hi" and "Hello" with the recipient's name, and demanded 1.3649 BTC (about $1,000), rising to 2.7298 BTC if unpaid within five days.
What's compelling: Because the payload was hosted on Tor and reached through a Tor2Web proxy, takedown was far less likely than with traditionally hosted malicious files, and Talos noted that blocking all Tor2Web and Tor traffic would have largely mitigated this threat.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026