Cerberus
Cerberus is an Android banking trojan. The provided content describes it as a well-known mobile banker that has been rented and sold in underground forums, with reporting that its maintainer auctioned the full project including source code, APK, module, admin panel, servers, scripts, and customer contacts. Cerberus was promoted as a more reliable alternative to Anubis-based bankers, and ThreatFabric reported it was not a clone of Anubis. Its source code was later leaked and subsequently reused by newer Android malware such as Perseus, which was explicitly described as being built on leaked Cerberus code.
High-confidence capabilities mentioned in the content include collecting SMS messages, sending SMS messages, obtaining the device contact list, collecting device information such as the default SMS application and device locale, and communicating with command-and-control infrastructure over HTTP. Additional reporting in the content states Cerberus can spoof banking notifications, prompt victims for banking credentials, steal two-factor authentication codes, run installed apps, perform keylogging, and record audio. These capabilities are described as enabling interception of OTPs and bypass of MFA for unauthorized transactions.
The malware is associated with Android-focused financial fraud and credential theft. The content links Cerberus to campaigns delivered through trojanized Android installers and smishing, where victims are lured into downloading malicious installers that deploy Cerberus and other malware. Another report cited in the content states ErrTraffic/ClickFix campaigns can deliver Cerberus as the Android payload. The content also notes broader Android banking trojan activity involving Cerberus in regions such as Brazil, Turkey, Spain, Italy, and Southeast Asia, though specific Cerberus-only targeting details are limited.
Cerberus is repeatedly referenced as a prolific Android malware family whose leaked code influenced successor malware. It is also mentioned in relation to campaigns and malware ecosystems involving Android credential theft, interception of authentication codes, and abuse of contact lists. No single set of IoCs is provided in the content beyond behavioral indicators such as HTTP C2 communications and theft of SMS, contacts, device metadata, banking credentials, and 2FA codes.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
10 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique"A new wave of smishing attacks is exploiting user trust by embedding well-known brand names such as FedEx and Microsoft into deceptive URLs and group text messages"
Execution
1 techniqueThreatFabric saw a spike in malicious unofficial streaming apps... These apps are not on Google Play, so installing one means clicking past the warnings that would normally block it.
Privilege Escalation
1 technique“As is the case with most bankers, it relies heavily on abusing the Accessibility Service.”
Stealth
2 techniquesCerberus bot has extensive functionality, being able to spoof notifications from the banking service present on the device to prompt the victim to type in login credentials
Credential Access
3 techniquesCerberus bot has extensive functionality, being able to spoof notifications from the banking service present on the device to prompt the victim to type in login credentials, and steal two-factor authentication codes
"...intercepting authentication codes"
"...capable of stealing credentials"
Discovery
1 techniqueCollection
1 techniqueCommand and Control
2 techniquesAbstractEmu can use HTTP to communicate with the C2 server; AhRat can communicate with the C2 using HTTPS requests; BRATA can use both HTTP and WebSockets to communicate with the C2 server; LightSpy has used both HTTPS and Websockets to communicate with the C2.
Most banking trojans are modular in design. After initial infection, they can download additional functionality tailored to the victim, enabling credential theft, session hijacking, or remote access.
IOCs tracked for this family
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Other indicator types observed in public reporting.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Older Android banking trojan whose leaked source code was used as the basis for Perseus.
Referenced as a previous Android threat family that Perseus builds upon.
Referenced as a predecessor Android banking trojan whose leaked source code was used in the development of Perseus.
Older Android banking trojan malware family whose leaked source code was used as a basis for Perseus.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.