LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0480: Cerberus

Cerberus is a banking trojan whose usage can be rented on underground forums and marketplaces. Prior to being available to rent, the authors of Cerberus claim was used in private operations for two years.[1]

MobileS0480MalwareObject v1.1Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

S0480: Cerberus describes [Cerberus](https://attack.mitre.org/software/S0480) is a banking trojan whose usage can be rented on underground forums and marketplaces. Prior to being available to rent, the authors of [Cerberus](https://attack.mitre.org/software/S0480) claim was used in private operations for two years.(Citation: Threat Fabric Cerberus)

Executive priority

S0480: Cerberus is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate S0480: Cerberus by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (Android), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

  • Official ATT&CK relationships and object metadata

Detection direction

  • Validate whether S0480: Cerberus appears in your detection coverage and tabletop scenarios.
  • Use the object to align executive risk language with SOC, incident response, and detection engineering work.
  • Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

  • Map the object to existing controls and identify missing telemetry or response ownership.
  • Prioritize mitigations that reduce exposure on the listed platforms and tactics.
  • Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Cerberus

Cerberus is a banking trojan whose usage can be rented on underground forums and marketplaces. Prior to being available to rent, the authors of Cerberus claim was used in private operations for two years.[1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

18 rows
DomainIDNameRelationship / procedure
MobileT1509Non-Standard Port

Cerberus communicates with the C2 using HTTP requests over port 8888.CitationCheckPoint Cerberus

MobileT1628.001Suppress Application IconSub-technique

Cerberus hides its icon from the application drawer after being launched for the first time.[1]

MobileT1407Download New Code at Runtime

Cerberus can update the malicious payload module on command.[1]

MobileT1406Obfuscated Files or Information

Cerberus uses standard payload and string obfuscation techniques.[1]

MobileT1633.001System ChecksSub-technique

Cerberus avoids being analyzed by only activating the malware after recording a certain number of steps from the accelerometer.[1]

MobileT1636.003Contact ListSub-technique

Cerberus can obtain the device’s contact list.[1]

MobileT1636.004SMS MessagesSub-technique

Cerberus can collect SMS messages from a device.[1]

MobileT1417.002GUI Input CaptureSub-technique

Cerberus can generate fake notifications and launch overlay attacks against attacker-specified applications.[1]

MobileT1655.001Match Legitimate Name or LocationSub-technique

Cerberus has pretended to be an Adobe Flash Player installer.CitationForbes Cerberus

MobileT1430Location Tracking

Cerberus can collect the device’s location.[1]

MobileT1582SMS Control

Cerberus can send SMS messages from a device.[1]

MobileT1629.003Disable or Modify ToolsSub-technique

Cerberus disables Google Play Protect to prevent its discovery and deletion in the future.[1]

MobileT1437.001Web ProtocolsSub-technique

Cerberus communicates with the C2 server using HTTP.CitationCheckPoint Cerberus

MobileT1426System Information Discovery

Cerberus can collect device information, such as the default SMS app and device locale.[1]CitationCheckPoint Cerberus

MobileT1418Software Discovery

Cerberus can obtain a list of installed applications.[1]

MobileT1630.001Uninstall Malicious ApplicationSub-technique

Cerberus can uninstall itself from a device on command.[1]

MobileT1417.001KeyloggingSub-technique

Cerberus can record keystrokes.[1]

MobileT1516Input Injection

Cerberus can inject input to grant itself additional permissions without user interaction and to prevent application removal.[1]CitationCheckPoint Cerberus

Relationship explorer

All related ATT&CK context

uses · TechniqueT1509: Non-Standard PortMobileuses · TechniqueT1628.001: Suppress Application IconMobileuses · TechniqueT1407: Download New Code at RuntimeMobileuses · TechniqueT1406: Obfuscated Files or InformationMobileuses · TechniqueT1633.001: System ChecksMobileuses · TechniqueT1636.003: Contact ListMobileuses · TechniqueT1636.004: SMS MessagesMobileuses · TechniqueT1417.002: GUI Input CaptureMobileuses · TechniqueT1655.001: Match Legitimate Name or LocationMobileuses · TechniqueT1430: Location TrackingMobileuses · TechniqueT1582: SMS ControlMobileuses · TechniqueT1629.003: Disable or Modify ToolsMobileuses · TechniqueT1437.001: Web ProtocolsMobileuses · TechniqueT1426: System Information DiscoveryMobileuses · TechniqueT1418: Software DiscoveryMobileuses · TechniqueT1630.001: Uninstall Malicious ApplicationMobileuses · TechniqueT1417.001: KeyloggingMobileuses · TechniqueT1516: Input InjectionMobile
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.2
Object version
1.1
Created
Modified
Raw hash
24287d67ec96066f...
Imported snapshots across ATT&CK releases(2)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.21.1Current bundle24287d67ec96…
19.11.1Older bundle24287d67ec96…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Threat Fabric Cerberus

    Threat Fabric. (2019, August). Cerberus - A new banking Trojan from the underworld. Retrieved June 26, 2020.

    Open source URL
  2. [2]
    mitre-attackS0480
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use