Cerber

Cerber is a ransomware family and early ransomware-as-a-service (RaaS) operation active since at least 2016. Multiple sources in the content describe Cerber as a partnerka/RaaS platform operated by the actor "crbr," which distributed Cerber builds to affiliates in exchange for a share of ransom revenue. Affiliates were reported to spread Cerber through vectors including spam and malvertising, and Cerber was also delivered by the Magnitude exploit kit. Magnitude later replaced Cerber with Magniber in 2017.

The malware is primarily associated with file encryption and ransom-note delivery. Older Cerber variants are described as using the extension ".locked" and HTML ransom notes such as "$$RECOVERYREDME$$.html." Newer activity observed in late 2023 used the extension ".L0CK3D" and dropped text ransom notes named "read-me3.txt." Trend Micro identified the 2023 samples as Cerber based on strong similarity to older Cerber payment-site content and interface text, despite these note and extension differences.

Cerber has been observed using blockchain-related infrastructure in some versions. The content states that Cerber versions 4.1.0 and later used BlockCypher over HTTP to retrieve Bitcoin-address transaction information via api.blockcypher.com. This is explicitly contrasted with a separate .NET downloader that used Ethereum transaction data and was only noted as analogous to Cerber’s BlockCypher usage.

Recent reporting in the content links Cerber to exploitation of Atlassian Confluence vulnerability CVE-2023-22518. Trend Micro reported attackers exploiting this improper-authorization flaw in Confluence Data Center and Server to gain access, execute an encoded PowerShell downloader, retrieve and decrypt the payload, and encrypt files with the ".L0CK3D" extension while dropping "read-me3.txt" ransom notes. The same reporting also observed Linux bash scripts, including "bapo.sh," used to deploy a Linux Cerber variant. Separate reporting from Cado Security Labs describes a Linux Cerber variant also referred to as C3RB3R: attackers exploited CVE-2023-22518 to reset Confluence and create a new administrator account, deployed the Effluence web shell plugin for command execution, then staged heavily obfuscated UPX-packed 64-bit ELF Cerber payloads. Those payloads acted as a stager, attempted to create /var/lock/0init-ld.lo, contacted 45.145.6.112 to fetch additional components, logged to /tmp/log.0 and /tmp/log.1, searched for encryptable directories, dropped ransom notes, and encrypted files with the ".L0CK3D" extension. In default Confluence deployments, impact may be limited to files owned by the low-privilege "confluence" user, though the Confluence datastore can still be encrypted.

The content also mentions infrastructure associations: IP 194.165.16[.]80 was described as a repurposed Cobalt Strike C2 that also had recent Cerber ransomware samples as late as October 2023, and 194.165.16[.]64 and 194.165.16[.]92 were likewise reported as having been used by Cerber ransomware. More broadly, Cerber is repeatedly cited as a prominent ransomware family in historical reporting, including botnet-controller and ransomware trend analyses from 2016 and 2017.