Description
Cerber is a ransomware as a service operation that dominated the criminal market from 2016 to 2017, renting out its encryption platform to affiliates in exchange for a share of payments. It spread through spam emails with malicious macros, exploited vulnerabilities, and other delivery chains, and it encrypted victim files with strong cryptography while displaying ransom demands in multiple languages. The family faded after 2017, and its business model shaped the affiliate driven ransomware operations that followed.
Stats
- First seen
- March 2022
- Last seen
- October 2026
Alert name variants
| Alert Name |
|---|
| ByteCode-MSIL.Trojan.Cerber |
| DeepScan:Generic.Cerber.NEW.A.17E9AA0A |
| Document-HTML.Ransomware.Cerber |
| Document-Word.Ransomware.Cerber |
| Dropped:Trojan.Ransom.Cerber.AAJ |
| Gen:Heur.NSIS.Cerber.2 |
| Gen:Heur.Ransom.Cerber.2 |
| Gen:Variant.Ransom.Cerber.1025 |
| Gen:Variant.Ransom.Cerber.1042 |
| Gen:Variant.Ransom.Cerber.168 |
