{
  "family": "cerberus",
  "sample_count": 1500,
  "category": "trojan",
  "description": "Cerberus is a highly sophisticated Android banking Trojan that emerged in 2019, initially operating under a Malware-as-a-Service (MaaS) model on underground forums. It is specifically engineered to steal financial data, including banking credentials, credit card numbers, and bypassing two-factor authentication (2FA). Cerberus achieves this by utilizing Android Accessibility Services to perform overlay attacks, displaying fake login screens over legitimate banking applications to harvest user inputs. Furthermore, it can intercept SMS messages and Google Authenticator codes, effectively neutralizing common multi-factor authentication defenses. In addition to banking fraud, Cerberus functions as a robust RAT, allowing operators to remotely control the infected device, uninstall applications, and lock the screen. In 2020, following a failed auction by its creator, the source code for Cerberus was leaked to the public, leading to a massive proliferation of variants and empowering numerous cybercriminal groups to launch their own customized banking attacks across the globe.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Android.Cerberus",
    "Cerberus Banking Trojan"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Cerberus?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is a potent Android banking trojan designed to steal financial credentials and bypass 2FA."
      }
    },
    {
      "@type": "Question",
      "name": "How does Cerberus steal passwords?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It uses overlay attacks by drawing a fake login screen on top of legitimate banking apps."
      }
    },
    {
      "@type": "Question",
      "name": "Can it bypass two-factor authentication?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes, by intercepting SMS messages and utilizing Android accessibility features to read Google Authenticator codes."
      }
    },
    {
      "@type": "Question",
      "name": "Why did Cerberus become so widespread?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Its source code was leaked in 2020, allowing any threat actor to create and distribute their own versions."
      }
    },
    {
      "@type": "Question",
      "name": "How is it typically distributed?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is usually spread via malicious apps on third-party stores or phishing campaigns posing as legitimate software updates."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1626",
    "T1629",
    "T1628"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1626",
      "name": "Technique",
      "tactic": "Execution"
    },
    {
      "id": "T1629",
      "name": "Financial Theft: SMS Toll Fraud (Sending premium SMS messages)",
      "tactic": "Impact"
    },
    {
      "id": "T1628",
      "name": "Abuse Elevation Control Mechanism: Accessibility Features",
      "tactic": "Privilege Escalation"
    }
  ],
  "containment_steps": [
    "Isolate affected endpoints from the network immediately to sever unauthorized command and control communication.",
    "Identify and terminate active Cerberus binaries and associated parent-child process chains.",
    "Audit persistence vectors including Registry Run keys, Scheduled Tasks, and services for unauthorized entries.",
    "Collect forensic disk and memory triage artifacts before conducting system re-imaging."
  ],
  "what_to_avoid": [
    "Do not attempt manual string or file deletion while network connections remain active; this can trigger secondary dropper routines.",
    "Avoid restoring from backups without verifying that the backup snapshot predates initial Cerberus installation."
  ],
  "cisa_advisory": null,
  "last_updated": "2026-08-01",
  "sources": [
    {
      "name": "ThreatFabric Labs - Cerberus: A New Banking Trojan from the Underworld",
      "url": "https://www.threatfabric.com/blogs/cerberus-a-new-banking-trojan-from-the-underworld.html"
    },
    {
      "name": "Kaspersky Securelist - The Evolution of Cerberus Android Banking Trojan",
      "url": "https://securelist.com"
    },
    {
      "name": "NIST National Vulnerability Database - CVE-2020-0096 (StrandHogg)",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-0096"
    }
  ],
  "ecosystem": [
    "android"
  ],
  "attack_stage": [
    "initial_access",
    "execution"
  ],
  "is_emerging": false,
  "verification_status": "analyst_verified",
  "severity_rating": "medium",
  "first_seen": 2019,
  "motivation": "Financial Theft",
  "threat_actors": [
    "Cerberus Group",
    "Cybercriminal Syndicates"
  ],
  "target_geographies": [
    "Europe",
    "North America",
    "Latin America",
    "Asia-Pacific"
  ],
  "target_industries": [
    "Financial Services",
    "Banking",
    "Cryptocurrency",
    "Consumers"
  ],
  "lineage": {
    "derived_from": [
      "android_maas_banking_platform"
    ],
    "variants": [
      "alien_banking_trojan",
      "cerberus_v2",
      "cerberus_leaked_build"
    ]
  },
  "d3fend": [
    "D3-PSA",
    "D3-MFA",
    "D3-NTA",
    "D3-ARA",
    "D3-UDL"
  ],
  "cve": [
    "CVE-2019-2187",
    "CVE-2020-0096"
  ],
  "iocs": {
    "file_hashes": [
      "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2",
      "b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3"
    ],
    "delivery": [
      "Malicious dropper applications hosted on third-party Android APK repositories",
      "Smishing (SMS phishing) lures masquerading as bank security updates and delivery notifications"
    ],
    "persistence": [
      "Abuse of Android Accessibility Services API to grant Device Administrator privileges",
      "WakeLock acquisition and background foreground service execution disguised as Battery Saver"
    ]
  },
  "target_platforms": [
    "Android"
  ]
}