cerberimposter
- First seen
- 2021-11-01 00:00:00
- Malware type
- ransomware
- Family
- Malware family
- Profile updated
- 2026-07-07 13:58:12
Targeted industries: technology-and-telecommunications professional-services government-and-public-sector
Targeted regions: country_code:us country_code:de country_code:cn country_code:ru
Context
Cerber Imposer is a post-2019 rebrand of the Cerber ransomware family, resurfacing in late 2021 with updated targeting of enterprise environments. Unlike its classic counterpart, Cerber Imposer utilizes the .locked file extension and includes a unique recovery note named __$$RECOVERY_README$$__.html. It does not reuse the original Cerber codebase; instead it borrows branding while operating under new cryptographic implementations and deployment tactics. Threat actors have leveraged known remote code execution vulnerabilities in Atlassian Confluence (CVE-2021-26084) and GitLab (CVE-2021-22205) to deliver this ransomware. The rebranded variant has compromised servers in the U.S., Germany, China, and Russia, indicating a broader scope of targeting than originally seen with early Cerber campaigns.
Exploited vulnerabilities
- CVE-2021-22205 (vulnerability)
- CVE-2021-26084 (vulnerability)
Reports & references
- ransomlook.io — Cerberimposter (report)
- bleepingcomputer.com — New Cerber Ransomware Targets Confluence And Gitlab Servers (report)
- sentinelone.com — Cerber2021 Ransomware Back In Action (report)
- elastio.com — Cerber 2021 (report)