Discovered by Trend Micro researchers and detected as RANSOM_CERBER.F117AK, this Cerber variant has first popped up online on January 20 and has baffled researchers ever since, as no one could explain why it left security products up and running.