Cerber
Aliases: CRBR ENCRYPTOR
- First seen
- 2016-03-01 00:00:00
- Malware type
- ransomware
- Family
- Malware family
- Last IoC activity
- 2026-07-22 04:03:53
- Profile updated
- 2026-07-07 15:42:20
Targeted industries: financial-services healthcare-and-pharmaceutical education-and-nonprofits government-and-public-sector retail-and-hospitality
Context
Cerber is a sophisticated ransomware family known for its as-a-service model, targeting various industries with file encryption and extortion demands. It is typically delivered through phishing emails or exploit kits.
Detection coverage
- 2 YARA rules
Detection rules
- MALPEDIA_Win_Cerber_Auto (yara-rule)
- CAPE_Cerber (yara-rule)
Reports & references
- blog.malwarebytes.org — Cerber Ransomware New But Mature (report)
- community.rsa.com — The Evolution Of Cerber V410 (report)
- bleepingcomputer.com — Cerber Renames Itself As Crbr Encryptor To Be A Pita (report)
- blogs.blackberry.com — Kraken The Code On Prometheus (report)
- krebsonsecurity.com — Ransomware Gangs And The Name Game Distraction (report)
- CISA — Aa20 345A (report)
- Trend Micro — Ransomware As A Service Enabler Of Widespread Attacks (report)
- ESET — Eset Threat Report Q22020 (report)
- youtube.com — Watch (report)
- ptsecurity.com — Paas Or How Hackers Evade Antivirus Software (report)
- blackberry.com — Report Bb 2021 Threat Report (report)
- research.checkpoint.com — Following The Scent Of Trickgate 6 Year Old Packer Used To Deploy The Most Wanted Malware (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Cerber (report)
- blog.malwarebytes.com — Cerber Ransomware New But Mature (report)
- gdatasoftware.com — 31666 Ransomware Identification For The Judicious Analyst (report)
- youtube.com — Watch (report)
- rinseandrepeatanalysis.blogspot.com — Reversing Cerber Raas (report)
- i.blackhat.com — As21 Taniguchi How Did The Adversaries Abusing The Bitcoin Blockchain Evade Our Takeover (report)
- virusbulletin.com — Vb2017 Paper Nine Circles Cerber (report)
- justice.gov — Download (report)
- Trend Micro — Cerber Starts Evading Machine Learning (report)
- storage.googleapis.com — Ce44Cbda9Fdc061050C1D2A5Dec0270874A9Dc85 (report)
- news.sophos.com — Confluence Exploits Used To Drop Ransomware On Vulnerable Servers (report)