Recent versions of the Cerber ransomware are behaving somewhat different from older variants, with the ransomware not deleting shadow volume copies, prioritizing specific folders and ignoring others. The reason why this happen is unknown, but this modification has been spotted only in recent variants, and it doesn’t mean it won’t be removed in a future version. Cerber is the same threat as before, still undecryptable, but the ransom screen appears to have changed because it now uses a background highlight instead of a green background highlight.
Source: https://www.bleepingcomputer.com/news/security/cerber-ransomware-doesnt-delete-shadow-volume-copies-anymore-prioritizes-office-docs/