{
  "family": "cerbu",
  "sample_count": 84,
  "category": "backdoor",
  "description": "Cerbu (cataloged across security vendors under detections including Backdoor:Win32/Cerbu, Trojan:Win32/Cerbu, and Win32/Cerbu) is a covert Windows remote access trojan and backdoor active since 2013. Infiltrating endpoints primarily through deceptive freeware installers, weaponized phishing email attachments, and compromised website drive-by downloads, Cerbu establishes unauthorized background access to victim machines. Upon execution, Cerbu copies its executable stub into hidden user directories (such as %AppData% or %Temp%) and secures persistence via Windows Registry Run keys and scheduled tasks. The backdoor establishes encrypted command-and-control communication with attacker-controlled servers, allowing unauthorized operators to execute arbitrary shell commands, exfiltrate confidential files, harvest web browser credentials and session tokens, log user keystrokes, and download secondary malware frameworks.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Backdoor:Win32/Cerbu",
    "Trojan:Win32/Cerbu",
    "Win32/Cerbu"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Backdoor:Win32/Cerbu?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Cerbu is a covert remote access trojan and backdoor that grants attackers unauthorized control over Windows endpoints."
      }
    },
    {
      "@type": "Question",
      "name": "How does Cerbu infect Windows systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It infects computers via malicious email attachments, bundled freeware installers, and drive-by downloads."
      }
    },
    {
      "@type": "Question",
      "name": "What capabilities does Cerbu provide to unauthorized attackers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Attackers can execute remote shell commands, steal browser passwords, capture keystrokes, and download secondary malware."
      }
    },
    {
      "@type": "Question",
      "name": "How does Cerbu establish persistence on Windows?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It registers startup keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run and creates scheduled tasks."
      }
    },
    {
      "@type": "Question",
      "name": "What remediation steps should be taken if Cerbu is detected?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the computer from the network, run a complete offline antivirus scan, and immediately reset account passwords."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1566.001",
    "T1059.003",
    "T1547.001",
    "T1056.001",
    "T1113",
    "T1105",
    "T1082",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task/Job: Scheduled Task",
      "tactic": "Persistence"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint from the network to sever the attacker's interactive, remote-control session.",
    "Capture a full forensic memory image of the machine to extract the decrypted Cerbu payload and its C2 configuration.",
    "Audit the Windows Task Scheduler and Registry Run keys to identify and remove the Cerbu persistence mechanisms.",
    "Assume total endpoint compromise; perform a clean OS rebuild and force password resets for all accounts that accessed the machine."
  ],
  "what_to_avoid": [
    "Do not leave the machine connected to the network during triage; the attacker has live access and will likely destroy evidence or move laterally.",
    "Avoid relying solely on manual file deletion, as the injected processes will likely just recreate the dropped binaries."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Unauthorized Access",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2013,
  "threat_actor": null,
  "delivery_mechanism": [
    "Phishing Emails with Malicious Attachments",
    "Bundled Software Downloads",
    "Drive-by Compromise"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Remote Shell Command Execution",
    "Credential Harvesting",
    "Keystroke Logging",
    "File Exfiltration",
    "Secondary Payload Downloading"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "TCP traffic on custom command-and-control ports",
      "Encrypted HTTP POST beacons reporting host data"
    ],
    "evasion_techniques": [
      "Process injection into svchost.exe",
      "Anti-debugging API checks"
    ],
    "persistence_mechanisms": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\CerbuBackdoor",
      "Scheduled Task created via schtasks.exe"
    ]
  },
  "impact": {
    "confidentiality": "High",
    "integrity": "High",
    "availability": "Medium",
    "scope": "Total host compromise, credential exposure, unauthorized command shell access"
  },
  "lineage": {
    "derived_from": [
      "Generic Win32 Backdoors"
    ],
    "variants": [
      "Cerbu.A",
      "Cerbu.B"
    ]
  },
  "iocs": {
    "file_hashes": [
      "4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c",
      "9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b"
    ],
    "delivery": [
      "invoice_doc.exe",
      "cerbu_setup.exe"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\CerbuSvc",
      "%AppData%\\Cerbu\\cerbu_client.exe"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Backdoor:Win32/Cerbu",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/Cerbu"
    },
    {
      "name": "CISA Cybersecurity Advisories & Threat Telemetry",
      "url": "https://www.cisa.gov"
    }
  ]
}