BERT Ransomware's First Moves: Kill the VMs, Kill the Backups

**Executive summary:** The BERT ransomware group, first observed in April 2025, targets hybrid and virtualized environments (notably VMware ESXi) across Asia, Europe, and the U.S.; its Linux variant forcibly shuts down ESXi VMs before multithreaded encryption (up to 50 threads) begins, while the Windows variant uses a PowerShell loader that escalates privileges, disables defenses, terminates critical services, and appends extensions such as ".encryptedbybert" and ".encrypted_by_bert"—posing high disruption and recovery impact to enterprise virtualized infrastructures.