{
  "family": "cerber",
  "sample_count": 1792,
  "category": "ransomware",
  "description": "Cerber is ransomware that uses a ransomware-as-a-service (RaaS) model, where affiliates purchase and spread the malware and pay commissions to its developers. Per Malwarebytes, it uses strong encryption with no free decryptors available, may run silently during encryption, and may disable antivirus programs and system restoration to pressure victims into paying. It has been distributed through bundled software, email, and website vulnerabilities.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Cerber"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Cerber?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "A ransomware-as-a-service family that encrypts files with strong cryptography and demands payment."
      }
    },
    {
      "@type": "Question",
      "name": "How is Cerber sold and spread?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Through a RaaS model: affiliates buy and distribute it and pay commissions to the developers; distribution methods include bundled software, email, and website/software vulnerabilities."
      }
    },
    {
      "@type": "Question",
      "name": "Is there a free Cerber decryptor?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Per Malwarebytes, Cerber uses strong encryption and there are no free decryptors available."
      }
    },
    {
      "@type": "Question",
      "name": "How does Cerber avoid detection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It may run silently during encryption and attempt to disable antivirus programs and system-restore features."
      }
    },
    {
      "@type": "Question",
      "name": "How can I protect against Cerber?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Avoid suspicious downloads and attachments, keep software patched, use reputable security software, and keep tested offline backups."
      }
    },
    {
      "@type": "Question",
      "name": "Where can I read an authoritative source on Cerber?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Malwarebytes maintains a Ransom.Cerber detection page, linked on this page."
      }
    }
  ],
  "faq_count": 6,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1566.001",
    "T1204.002",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "sources": [
    {
      "name": "Malwarebytes: Ransom.Cerber",
      "url": "https://www.malwarebytes.com/blog/detections/ransom-cerber"
    }
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}