Cerber2 ransomware was found.
Cerber was known as the talking ransomware and this is the variant of it.

Attacking procedure
1. scvhost.exe(not svchost) is running
2. call the subprocess(process name were changed every time).
3. svchost.exe is stopped and delete its file.
4. Subprocess is encrypting files.
5. Filename is changed to the conbined name.
6. The extension of filename is changed to .cerber2

We found the one of C&C server and its address 31.184.235.255(Russia).

RansomFree is blocking ransom attacks by preventing malicious behavior.
Thus RansomFree is blocking even the variant or unknown ransomware.