--- title: Cerber Ransomware Is Not on Vacation This Summer description: The well known Cerber ransomware continues to be active this summer. It spreads via spear phishing email campaigns, targeting enterprises. canonical_url: https://www.acronis.com/en/blog/posts/cerber-ransomware-not-vacation-summer/ locale: en last_updated: 2026-10-27 --- [Acronis Blog](https://www.acronis.com/en/blog/) # Cerber Ransomware Is Not on Vacation This Summer The latest Cerber ransomware easily bypasses traditional defenses. The analyzed Cerber sample was only detected as a suspicious malicious object by nine out of 64 antiviruses on the first submission to Virustotal. The low detection rate can be explained by the fact that the cryptolocker is using a polymorphic encryptor and API call obfuscation to protect its copies from being detected by antiviruses. [Learn More](https://www.acronis.com/en/products/cyber-protect/) [![Image 2: MSP Threats Security Team](https://staticfiles.acronis.com/images/content/1578b8dff96325855c4525d865e7fc63.png)](https://www.acronis.com/en/blog/authors/acronis-security-team/ "MSP Threats Security Team") [MSP Threats Security Team](https://www.acronis.com/en/blog/authors/acronis-security-team/) 12 min read Last updated 24 July 2026 The well known Cerber ransomware continues to be active this summer. The size of the cryptolocker varies between 244 to 292 Kbytes, with the new builds spreading through spear phishing email campaigns targeting enterprises. The latest Cerber ransomware easily bypasses traditional defences. The analysed Cerber sample (MD5: cfd2d6f189b04d42618007fc9c540352) was only detected as a suspicious malicious object by nine out of 64 antiviruses on the first submission to Virustotal. The low detection rate can be explained by the fact that the cryptolocker is using a polymorphic encryptor and API call obfuscation to protect its copies from being detected by antiviruses. Static analysis The PE EXE file has a fake timestamp, Import Address Table and even Export Address Table. Export Address Table ![Image 3: Cerber Ransomware Export Address Table](https://staticfiles.acronis.com/images/content/fba2b87db3c30e140847544703fd018f.png) Cerber Ransomware Export Address Table Hiding the payload The latest builds of the Cerber’s code are even more protected with API call obfuscation. To hide the actual imports, Cerber loads them in runtime: ![Image 4: Cerber Ransomware runtime](https://staticfiles.acronis.com/images/content/52fdde6c0c099cf2a536fc1c8a128826.png) Cerber Ransomware runtime The actual Import Address Table looks like this: ![Image 5: Cerber Ransomware Import Address Table](https://staticfiles.acronis.com/images/content/3262f25a04376f754b7e57053942f27d.png) Cerber Ransomware Import Address Table Decrypting the configuration data The configuration JSON data is encrypted and stored as RCDATA in the resource section: ![Image 6: Cerber Ransomware Configuration](https://staticfiles.acronis.com/images/content/6793e3ec8aa7072bff5fc07a25bd8768.png) Cerber Ransomware Configuration To decrypt the configuration data, Cerber goes through the following steps: 1. Imports the hard coded RC4 128-bit key from the BLOB data which is 28 bytes in size. ![Image 7: Cerber Ransomware Configuration](https://staticfiles.acronis.com/images/content/aa4fb7dd50a977eff27a07086d8832a0.png) Cerber Ransomware Configuration 1st byte: BLOB type = PLAINTEXTKEYBLOB (0x08) 2nd byte: version = CUR_BLOB_VERSION (0x02) 5-8 bytes: algorithm id = CALG_RC4 (0x00006801) 9-12 bytes: key size in bytes = 16 (0x00000010) 13-28 bytes: key data ‘ ADBCCC55D6FB379BDA0E3262FF004E1D’ 2. Wipes the 128-bit encryption key from the memory with zeros after decryption: ![Image 8: Cerber Ransomware Configuration](https://staticfiles.acronis.com/images/content/140006daa8ad832be38c24a780972e7d.png) Cerber Ransomware Configuration 3. Calls the CryptEncrypt() function to decrypt the JSON config which is 107 171 bytes in size: ![Image 9: Cerber Ransomware Configuration](https://staticfiles.acronis.com/images/content/683e406e107f6e4c690470200d8a4f44.png) Cerber Ransomware Configuration Configuration parameters The Cerber configuration contains the following information: * Blacklist File extensions for the files not to be encrypted: bat, cmd, com, cpl, dll, exe, hta, msc, msi, msp, pif, scf, scr, sys Files: Bootsect.bak Iconcache.db Ntuser.dat thumbs.db Folders that the cryptolocker should avoid when encrypting files: ":\\$getcurrent\\", ":\\$recycle.bin\\", ":\\$windows.~bt\\", ":\\$windows.~ws\\", ":\\boot\\", ":\\documents and settings\\all users\\", ":\\documents and settings\\default user\\", ":\\documents and settings\\localservice\\", ":\\documents and settings\\networkservice\\", ":\\intel\\", ":\\msocache\\", ":\\perflogs\\", ":\\program files (x86)\\", ":\\program files\\", ":\\programdata\\", ":\\recovery\\", ":\\recycled\\", ":\\recycler\\", ":\\system volume information\\", ":\\temp\\", ":\\windows.old\\", ":\\windows10upgrade\\", ":\\windows\\", ":\\winnt\\", "\\appdata\\local\\", "\\appdata\\locallow\\", "\\appdata\\roaming\\", "\\local settings\\", "\\public\\music\\sample music\\", "\\public\\pictures\\sample pictures\\", "\\public\\videos\\sample videos\\", "\\tor browser\\" Languages that make OS protected from the cryptolocker: 1049: Russian, 1058: Ukrainian 1059: Belarusian, 1064: Tajik, 1067: Armenian, 1068: Azeri (Latin), 1079: Georgian, 1087: Kazakh, 1088: Kyrgyz (Cyrillic), 1090: Turkmen, 1091: Uzbek (Latin), 1092 : Tatar (Russia), 2072: Romanian (Moldova), 2073: Russian (Moldova), 2092: Azeri (Cyrillic), 2115: Uzbek (Cyrillic). * Whitelist Folders that should be encrypted: "\\bitcoin\\", "\\excel\\", "\\microsoft sql server\\", "\\microsoft\\excel\\", "\\microsoft\\microsoft sql server\\", "\\microsoft\\office\\", "\\microsoft\\onenote\\", "\\microsoft\\outlook\\", "\\microsoft\\powerpoint\\", "\\microsoft\\word\\", "\\office\\", "\\onenote\\", "\\outlook\\", "\\powerpoint\\", "\\steam\\", "\\the bat!\\", "\\thunderbird\\", "\\word\\" Global RSA 2048-bit public key: -----BEGIN PUBLIC KEY----- MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvkty5qhqEydR9076Fevp 0uMP7IZNms1AA7GPQUThMWbYiEYIhBKcT0/nwYrBq0Ogv79K1tta04EHTrXgcAp/ OJgBhz9N58aewd4yZBm2coeaDGvcGRAc9e72ObFQ/TME/Io7LZ5qXDWzDafI8LA8 JQmSz0L+/G+LPTWg7kPOpJT7WSkRb9T8w5QgZRJuvvhErHM83kO3ELTH+SoEI53p 4ENVwfNNEpOpnpOOSKQobtIw56CsQFrhac0sQlOjek/muVluxjiEmc0fszk2WLSn qryiMyzaI5DWBDjYKXA1tp2h/ygbkYdFYRbAEqwtLxT2wMfWPQI5OkhTa9tZqD0H nQIDAQAB -----END PUBLIC KEY----- ![Image 10: Cerber Ransomware Public Key](https://staticfiles.acronis.com/images/content/3c18c385742cbc05161adb81262c7c3e.png) Cerber Ransomware Public Key Traces on the hard disk Once being unpacked, Cerber stores its temporary data and encryption keys in a subfolder named using the first part of the Machine GUID, inside the Temp folder. For example: %Temp%\c36ab9c2 Encryption Cerber uses RC4 and RSA algorithms for encryption. Every file is encrypted using the RC4 algorithm with a unique 128-bit key. The file’s RC4 key is encrypted using a RSA-880 public session key generated on the victim’s machine. The prime numbers (p and q) used to calculate the RSA-880 session public key are encrypted using the RSA-2048 master public key delivered in the configuration data embedded in the cryptolocker’s file. The prime numbers can be decrypted with the RSA-2048 master key by the attacker to restore the RSA-880 session private key through calculating a private key exponent (d) using the extended Euclidean algorithm. The new file contains the encrypted RC4 key used to encrypt this file as well as the encrypted original file’s data, original filename, and checksum stored in a specific order. Cerber also adds a 60-byte block of randomly generated data into the middle of the file to complicate the encrypted file structure even more. Key encryption First, the RSA-2048 public key from the configuration file is decoded from Base64 to PEM format and then to PUBLICKEYBLOB: ![Image 11: Cerber Ransomware Key encryption](https://staticfiles.acronis.com/images/content/9a2f6ff73bfae5397d02f62ae30630e4.png) Cerber Ransomware Key encryption Once decoded, the CERT_PUBLIC_KEY_INFO structure contains a public key and its algorithm (OID_RSA_RSA "1.2.840.113549.1.1.1" - RSA is used to both encrypt and sign the content): ![Image 12: Cerber Ransomware CERT_PUBLIC_KEY_INFO](https://staticfiles.acronis.com/images/content/20ccfd8a4a7b3fa7df03891a1a10e24a.png) Cerber Ransomware CERT_PUBLIC_KEY_INFO The RSA-2048 public key is to be imported as PUBLICKEYBLOB. ![Image 13: Cerber Ransomware PUBLICKEYBLOB](https://staticfiles.acronis.com/images/content/f06bafdaba54518d056dd9965bb14d82.png) Cerber Ransomware PUBLICKEYBLOB ![Image 14: Cerber Ransomware PUBLICKEYBLOB](https://staticfiles.acronis.com/images/content/24707e02466fa09378b15a27082b43d2.png) Cerber Ransomware PUBLICKEYBLOB 1st byte: BLOB type = PUBLICKEYBLOB (0x06) 2nd byte: version = CUR_BLOB_VERSION (0x02) 5-8 bytes: algorithm id = CALG_RSA_KEYX (0x0000A400) 9-20 bytes: RSAPUBKEY {magic = ‘RSA1’, key length = 2048 bits, public exponent = 65537} 21-276 bytes: key data 256 bytes Then, Cerber creates another RSA public key but with an 880-bit modulus length and saves it to the temporary file: ![Image 15: Cerber Ransomware 880-bit modulus](https://staticfiles.acronis.com/images/content/03653c6fd8b12e3df3728df7ca635e97.png) Cerber Ransomware 880-bit modulus The RSA-2048 public key is used to encrypt an 114-byte block of data that consist of two prime numbers, each 55 bytes, generated for a RSA-880 public key that is used to encrypt the RC4 key and the 4-byte header that specifies the size of each block ‘37003700’: ![Image 16: Cerber Ransomware 114-byte block of data](https://staticfiles.acronis.com/images/content/6aa9e2f9b7fa2a6307367d6c4b8e9b18.png) Cerber Ransomware 114-byte block of data The encrypted block is stored in a tmp file in the %TEMP% folder and added to the end of every encrypted file: ![Image 17: Cerber Ransomware encrypted block](https://staticfiles.acronis.com/images/content/39893cdd55aed449869c7c401cc2b650.png) Cerber Ransomware encrypted block File encryption Cerber encrypts a file using the RC4 algorithm with a 128-bit key generated for every file that will be encrypted. After encryption, the file will contain the following data blocks: Offset Data 0 1800 Original file data (‘skip_bytes’ = 1800) 1800 1860 Randomly generated data (60 bytes) 1860 ... Encrypted data from offset 1860 (‘skip_bytes’ + 60) to the end of the original file The encrypted data containing the original filename, checksum, and RC4 key (48 bytes) Encrypted 99 bytes that includes header (39 bytes) and 60 bytes of the original file located after ‘skip_bytes’ (offset 1800) that were replaced with the randomly generated data (110 bytes). The header (39 bytes) includes: magic = FrbR, size of data, 16-byte RC4 key RSA-880 prime numbers p and q encrypted by RSA-2048 (256 bytes) ![Image 18: Cerber Ransomware File encryption](https://staticfiles.acronis.com/images/content/f260bc9c336ceadad37f475850c3a5d2.png) Cerber Ransomware File encryption The file with the encrypted data is renamed as: .<4th part of the Machine GUID> Ransom notes The ransom notes are stored in the folders together witht the encrypted files and are named in the following format: _R_E_A_D___T_H_I_S____.hta _R_E_A_D___T_H_I_S____.txt ![Image 19: Cerber Ransomware Ransom notes](https://staticfiles.acronis.com/images/content/b0b2a646664e9216c1871bc71bd72f51.png) Cerber Ransomware Ransom notes ![Image 20: Cerber Ransomware Ransom notes](https://staticfiles.acronis.com/images/content/b8a36aed3a38727335cf0b14cd110f19.png) Cerber Ransomware Ransom notes At the end of the encryption, the cryptolocker sets the familiar Cerber-style wallpaper: ![Image 21: Cerber Ransomware](https://staticfiles.acronis.com/images/content/3a14b94fbed6c0d7d06492c4fb4a1b62.png) Cerber Ransomware The wallpaper bitmap is generated based on the parameters mentioned in the configuration data: "wallpaper": { "change_wallpaper": 1, "background": 139, "color": 16777215, "size": 13, "text": " \n CRBR ENCRYPTOR ... } Communication Cerber Connects to 6893 port on the IPs specified by CIDR in the config: 77.12.57.0/27 19.48.17.0/27 ​87.98.176.0/22 The communication packet starts with a hash consisting of the Machine GUID: {MD5_KEY} and ending with {PARTNER_ID}{OS}{IS_X64}{IS_ADMIN}{COUNT_FILES}{STOP_REASON}{STATUS}. For example, Cerber tries to initiate a connection to the remote server from the range specified in the configuration data by sending a victim’s machine ID: ![Image 22: Cerber Ransomware Communication](https://staticfiles.acronis.com/images/content/ffdbb3a4664e40469c45fb1b9594a05b.png) Cerber Ransomware Communication Decryptor The Decryption Service is available through Tor at http://xpcx6erilkjced3j.onion/. For example: http://xpcx6erilkjced3j.onion/AA8A-60D2-7EC2-0446-A314 ![Image 23: Cerber Ransomware Decryptor](https://staticfiles.acronis.com/images/content/f6fd0d468b1e400455a6fcc9c8e36561.png) Cerber Ransomware Decryptor It requires solving the CAPTCHA ![Image 24: Cerber Ransomware CAPTCHA](https://staticfiles.acronis.com/images/content/132d16b7a410332f44790966d6908252.png) Cerber Ransomware CAPTCHA It requires a payment of 0.045 Bitcoins in five days, otherwise the price will be doubled. ![Image 25: Cerber Ransomware payment](https://staticfiles.acronis.com/images/content/ac728518172331b076f7d5c9fc7ff49f.png) Cerber Ransomware payment Payment The Bitcoin address used in the attack has not received any transaction yet. ![Image 26: Cerber Ransomware Bitcoin address](https://staticfiles.acronis.com/images/content/e503f5a603f799f23e64803a9d0e8c33.png) Cerber Ransomware Bitcoin address Conclusion * Cerber is spread through spear phishing email campaigns targeting enterprises. * Cerber uses polymorphic encryption and API calls obfuscation to bypass antivirus protection. * As in previous versions, it uses encrypted configuration data stored in a JSON format. * It uses the encryption scheme of master RSA-2048 key -> session RSA-880 -> RC4-128. * It is not possible to decrypt files without knowing the master private RSA-2048 key. * Cerber tries to connect to C&C using the IPs specified in the configuration data in order to send the encryption statistics. ## Acronis True Image 2018 Beta Blocks Cerber The new version of Acronis Active Protection, which is part of [Acronis True Image 2018 Beta](https://www.acronis.com/en-us/personal/computer-backup/beta/#registration), detects Cerber ransomware and instantly restores the affected files. Acronis Active Protection constantly observes patterns in how data files are being changed on a system. One set of behaviors may be typical and expected. Another set of behaviors may signal a suspect process taking hostile action against files. The Acronis approach looks at these actions and compares them to with malicious behavior patterns. This approach is exceptionally powerful in identifying ransomware attacks, even from [ransomware](https://www.acronis.com/en-us/ransomware-protection/) variants that are as-yet unreported. Read More: * [Undetected PowerShell Ransomware Easily Blocked by Acronis Active Protection](https://www.acronis.com/en-us/blog/posts/undetected-powershell-ransomware-easily-blocked-acronis-active-protection) * [NioGuard Security Lab: Are You Protected From Next Generation Ransomware Attacks?](https://www.acronis.com/en-us/blog/posts/nioguard-security-lab-are-you-protected-next-generation-ransomware-attacks) * [Osiris Ransomware: New Addition to the Locky Family](https://www.acronis.com/en-us/blog/posts/osiris-ransomware-new-addition-locky-family) [Cybersecurity](https://www.acronis.com/en/blog/tags/cybersecurity/) [Cyber protection](https://www.acronis.com/en/blog/tags/cyber-protection/) ## Written by ![Image 27: MSP Threats Security Team](https://staticfiles.acronis.com/images/content/1578b8dff96325855c4525d865e7fc63.png) MSP Threats Security Team [Previous post](https://www.acronis.com/en/blog/posts/scuderia-toro-rosso-deploys-acronis-access-advanced-secure-data-sharing/) [Scuderia Toro Rosso Deploys Acronis Access Advanced for Secure Data Sharing](https://www.acronis.com/en/blog/posts/scuderia-toro-rosso-deploys-acronis-access-advanced-secure-data-sharing/) [Next post](https://www.acronis.com/en/blog/posts/acronis-scuderia-toro-rosso-partnership-one-year/) [Acronis – Scuderia Toro Rosso Partnership: One Year On](https://www.acronis.com/en/blog/posts/acronis-scuderia-toro-rosso-partnership-one-year/) About Acronis Acronis is a leader in AI-native cyber protection, unifying data protection, cybersecurity, IT operations and hybrid infrastructure to deliver business continuity, security and compliance with less cost and complexity. More than 21,000 service providers trust Acronis to protect over 750,000 businesses in 150 countries. Acronis is headquartered in Schaffhausen, Switzerland. [Add as a preferred source on Google](https://google.com/preferences/source?q=acronis.com) ## Related stories Want to learn more? Read the latest stories featuring this solution on our blog. [Acronis Blog](https://www.acronis.com/en/blog/) ![Image 28: stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://staticfiles.acronis.com/images/blog-card/9600f3eea83b8f4e168ea6c1409c8c26.png) [stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://www.acronis.com/en/blog/posts/stc-bahrain-and-acronis-partner-to-bring-endpoint-security-to-businesses/) We are proud to announce a strategic partnership with stc Bahrain, expanding access to advanced cybersecurity services for businesses across Bahrain. **October 26, 2026**3 min read ![Image 29: Introducing New Acronis CEO: Prakash Panjwani](https://staticfiles.acronis.com/images/blog-card/30cb571f6f1aaa131733e5727a4a250c.png) [Introducing New Acronis CEO: Prakash Panjwani](https://www.acronis.com/en/blog/posts/introducing-new-acronis-ceo-prakash-panjwani/) We are pleased to announce the appointment of our new Chief Executive Officer, Prakash Panjwani. A veteran cybersecurity CEO, Panjwani previously served as CEO of WatchGuard Technologies and SafeNet. **October 15, 2026**2 min read ![Image 30: Acronis expands MDR toward broader workspace protection](https://staticfiles.acronis.com/images/blog-card/18e90e89f5ec4ef0901f19008d4ccbf2.png) [Acronis expands MDR toward broader workspace protection](https://www.acronis.com/en/blog/posts/acronis-expands-mdr-toward-broader-workspace-protection/) Acronis is expanding the MDR service with capabilities that make this expertise easier to deliver and help partners address more risks. The developments build on a broader commitment to managed security: helping service providers protect the connected workspace while giving customers access to the expertise needed to investigate threats, respond effectively and maintain business continuity. **October 13, 2026**6 min read