C3RB3R Ransomware Decryption & Data Recovery

"Lock3d" refers to this family. Searches for "Lock3d ransomware" or "L0CK3D extension" all point to the suffix C3RB3R leaves on encrypted files; different samples of the same family spell it with the letter O or the digit zero.

Timeline.

• December 2022: the first help requests appeared on the BleepingComputer forum, from a victim whose TerraMaster NAS external drive had every file renamed with .LOCK3D.
• November 2023: Atlassian disclosed CVE-2023-22518, an authorization flaw in Confluence Data Center and Server, on 31 October, and the first in-the-wild attacks appeared on 1 November. Rapid7, Red Canary, Huntress and SentinelOne reported the flaw being used to deploy C3RB3R; Atlassian confirmed ransomware attacks on 6 November and raised the CVSS score from 9.1 to 10. In the same period 360 received many reports from Linux users in China whose files now ended in .L0CK3D.
• January to April 2024: Arctic Wolf reported C3RB3R being deployed through a second Confluence flaw, CVE-2023-22527, mainly against Linux servers, and Cado Security published its analysis of the Linux variant in April.
• Since 2025: we found no new public incident reports, and trackers list the family as inactive. The code and tooling are in circulation, though, and servers with the old flaws unpatched can still be hit, so this page stays in service for response.

Attribution is disputed, and this page records both readings. 360 and SentinelOne call it a new Cerber variant, with SentinelOne noting that Cerber has existed in phases since 2016 and operated as a semi-private RaaS since around 2020. The other side carries weight too: ransomware researchers on the BleepingComputer forum state plainly that "C3RB3R is not a new variant of Cerber", describing it as based on leaked Conti v3 code, and note that genuine Cerber used .cerber-style extensions. Red Canary likewise assesses the sample as likely derived from leaked Conti material, its mutex being shared with several Conti-derived families. Rapid7 adds that the attacks were not necessarily the original Cerber operation but more likely someone reusing leaked code to "make a quick buck". For a victim the outcome is the same: no public decryptor exists, and response must be driven by the sample in hand.

Extension. An uppercase .LOCK3D (letter O) or .L0CK3D (zero) is appended to the full original name, so 1.jpg becomes 1.jpg.LOCK3D or 1.jpg.L0CK3D. Do not confuse it with TellYouThePass's lowercase .locked or the underscore-prefixed ._locked; those are entirely different families.

Ransom note. Every encrypted directory gets a read-me3.txt (the number in the name may vary) headed "C3RB3R INSTRUCTIONS". It tells victims to install Tor Browser, visit an .onion payment page and buy "C3rb3r Decryptor", and claims data was downloaded and will be sold on the dark web if unpaid.

Windows host indicators (360, Red Canary, SentinelOne):

• The payload lands as C:\Windows\Temp\svcPrvinit.exe (360's sample MD5 7415347d5ea5f0db29ec95a4a61aba90), runs silently with the -b 9 argument and deletes itself afterwards.
• Mutex hsfjuukjzloqu28oajh727190.
• Shadow copies are deleted one by one with wmic.exe (shadowcopy where "ID='{…}'" delete).
• Confluence's Tomcat / Java process spawns cmd and PowerShell.

Linux host indicators (Cado, SentinelOne): three UPX-packed 64-bit ELF payloads (a stager, a log checker and the encryptor), with the stager deleting itself after running; a Python script reads addresses from /tmp/lru, downloads a program named qnetd and that launches the encryptor.

Network indicators. Download servers in the 2023 wave: 193.176.179.41, 193.43.72.11 and 45.145.6.112.

Bottom line. A .LOCK3D / .L0CK3D extension plus read-me3.txt plus "C3RB3R INSTRUCTIONS" confirms the family. If the server also runs Confluence, the entry point is all but settled.

Confluence flaws (the main entry).

• CVE-2023-22518 (improper authorization, CVSS 10): an unauthenticated attacker can submit a "restore from backup" request to /json/setup-restore.action, reset Confluence and create an administrator account, then upload a web-shell plugin for command execution. Every unpatched version of Confluence Data Center and Server is affected.
• CVE-2023-22527 (template injection leading to remote code execution): Arctic Wolf reported attackers using it in early 2024 to deploy C3RB3R, mainly against Linux servers, alongside cryptominers and remote-access tools.

Once they have execution, the operators use PowerShell (Windows) or Python (Linux) scripts to work out whether a proxy is needed, then pull the encryptor from a download server and run it.

NAS and external storage. The first victims in late 2022 were TerraMaster NAS users, mostly on devices still running the older TOS 4.1 / 4.2.

Network shares. The Windows build walks and encrypts every reachable SMB share, so one compromised Confluence server can take file-server shares mapped to it down with it.

Algorithms. Red Canary and 360 report that files are encrypted with ChaCha (a refinement of Salsa20), consistent with the last Conti build; the sample also carries AES and RC4 for steps such as protecting keys. Encryption is multithreaded and covers local disks and network shares.

Destroying recovery paths. After encryption the Windows build deletes shadow copies one by one with wmic, then deletes itself.

The Linux build is limited by permissions. Cado's analysis notes that the encryptor walks from the filesystem root (/usr, /var and so on), but Confluence usually runs as the low-privilege confluence user, so only files that user can write get encrypted - Confluence attachments, indexes and local data, plus other directories it owns. System files and other users' data are often intact, which is the first thing to establish when assessing a Linux host.