Netskope Threat Labs

Cerbu

ATP Sandbox Adv. HeuristicsAVNetskope IPS

Cerbu is a malware downloader that can fetch and execute other malware families and maintain persistence on infected Windows systems. It typically arrives through spam email attachments and exploit driven infections, and its downloader behavior makes it an entry point for miners, stealers, and other payloads. Detections under this name indicate that a system has executed an installer connected to a larger infection chain.

First seen
January 2022
Last seen
October 2026
cerbu
Alert Name
Binary.Trojan.Cerbu
ByteCode-MSIL.Trojan.Cerbu
Gen:Variant.Adware.Cerbu.74406
Gen:Variant.Adware.Cerbu.74676
Gen:Variant.Adware.Cerbu.74796
Gen:Variant.Adware.Cerbu.75022
Gen:Variant.Adware.Cerbu.75065
Gen:Variant.Adware.Cerbu.75154
Gen:Variant.Adware.Cerbu.75155
Gen:Variant.Adware.Cerbu.75858