Loading threat actor…
crbr is the operator behind the Cerber ransomware-as-a-service ecosystem. Active by at least March 2016, crbr marketed Cerber through a private affiliate program on Russian-language underground forums, supplying ransomware builds and a management panel that allowed affiliates to track infections, encryption status, and ransom payments. The operator reportedly retained a substantial share of affiliate revenue, consistent with a mature partnerka model. Cerber became one of the most prominent ransomware families of its period and was distributed at scale through exploit kits and numerous affiliate-run campaigns. Victims were infected globally, with especially heavy impact reported in the Asia-Pacific region. The operation used per-victim payment workflows and cryptocurrency-based monetization designed to support affiliate revenue sharing and obscure proceeds. As the malware family operator, crbr is associated with initial access via third-party distribution channels, large-scale deployment, file encryption for extortion, and operational management of affiliate activity. Cerber’s ecosystem demonstrates strong post-compromise capability centered on encryption and monetization rather than espionage. The actor’s tradecraft reflects the professionalized Russian-speaking cybercriminal market, including controlled affiliate access, revenue sharing, and service-oriented criminal infrastructure.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
6 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Threat actor operating the Cerber ransomware affiliate program, distributing builds to affiliates while retaining control of development and infrastructure.
Operator behind the Cerber ransomware-as-a-service affiliate program, taking a 40% fee from affiliates and enabling large-scale ransomware campaigns.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.