Loading threat actor…
Cerber is an early ransomware-as-a-service (RaaS) operation that helped establish the affiliate-driven ransomware business model later adopted and industrialized by other major cybercriminal groups. It is widely recognized as one of the pioneering RaaS platforms, enabling distributors and affiliates to deploy ransomware at scale. Cerber is associated with financially motivated cybercrime and is notable for operational innovations intended to improve resilience and complicate disruption. Cerber has been linked in reporting to distributors and affiliate ecosystems that also intersected with other ransomware families, including GandCrab and CTB-Locker. Researchers have noted behavioral similarities between Cerber and GandCrab, and Cerber ceased claiming new victims around the time GandCrab emerged, contributing to longstanding assessments of lineage or ecosystem overlap within the ransomware underground. A distinctive technical characteristic attributed to Cerber is early experimentation with blockchain-derived command-and-control logic, including the use of Bitcoin transaction data to generate dynamic command-and-control domains. This reflects a broader emphasis on defense evasion and infrastructure resilience beyond static domain-based operations. As a ransomware operation, Cerber is associated with malware deployment, encryption-based extortion, persistence of criminal infrastructure through affiliate distribution, and post-compromise actions consistent with ransomware monetization.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
1 distinct technique observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An early ransomware operator experimenting with blockchain-derived dynamic C2 domain generation from Bitcoin transaction data.
Referenced as an early ransomware-as-a-service platform that pioneered the RaaS model.
Early ransomware-as-a-service operation referenced as behaviorally linked to GandCrab.
Mentioned only as a historical example of ransomware tied to arrests.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.