Cerber ransomware establishes connections to port 6893 on IPs specified by CIDR in the configuration. The communication packet initiation involves a hash prefixed with the Machine GUID (MD5_KEY).
Source: Quick Heal Antivirus Blog
Cerber Ransomware Exposed: A Comprehensive Analysis of Advanced Tactics, Encryption, and Evasion
- Kaspersky hits back at claims it helped Russia develop military drone systems
- Smoke and (screen) mirrors: A strange signed backdoor
- Kaspersky accused of helping Russia develop military drone systems
- Attackers evade detection by leveraging Microsoft Graph API
- Microsoft details broad plan to enhance its cybersecurity practices