Loading malware…
C3RB3R, also known as Cerber or CerberImposter, is ransomware deployed against Windows and Linux systems, including Synology network-attached storage devices. Its operators compromise internet-facing services to encrypt accessible data and demand cryptocurrency payments through Tor-based payment portals. Campaigns have targeted Atlassian Confluence and GitLab servers, including exploitation of CVE-2023-22518, CVE-2021-26084, and CVE-2021-22205. Confluence attack chains have used webshells and platform-specific scripts to download and execute the ransomware.
Linux variants targeting Synology DiskStation Manager recursively encrypt user data, shared storage, and accessible local backups using ChaCha8 encryption with RSA-2048 protection of encryption material. The ransomware excludes selected system directories and file types to preserve system operation during encryption, changes encrypted filenames, and deposits ransom notes in affected folders. Windows variants encrypt local volumes and accessible SMB shares and attempt to delete Volume Shadow Copies to impede recovery.
A campaign reported in October 2026 targeted Synology NAS devices running outdated DiskStation Manager software. Exploitation of previously patched vulnerabilities was associated with these attacks, but the precise entry point across individual incidents remains unresolved. Encryption and ransom demands are established behaviors; systematic data exfiltration has not been confirmed.
7 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
5 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
31 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.