Cerberus

Cerberus is a potent Android banking trojan that first surfaced on underground marketplaces in 2019. This malicious software, which operates as a hidden application on the victim's device, infiltrates systems via suspicious downloads, emails, or websites without the user's awareness. Once inside, it can steal personal information and disrupt operations. A new sophisticated campaign has been detected using an undetected Cerberus Android banking Trojan payload, according to cybersecurity provider Cyble. These samples use a multi-stage dropper to deploy a banking trojan payload that leverages the Cerberus banking Trojan. In 2020, following the leak of Cerberus' source code, a new variant called 'Alien' emerged, leveraging the same codebase. The subsequent year, another banking trojan named 'ERMAC,' which also builds on Cerberus' code, was observed targeting over 450 financial and social media apps. Despite being an older malware strain, the modified Cerberus used in these campaigns has successfully evaded detection by antivirus engines, further underscoring the persistent risks posed by retooled malware from previous leaks. The threat actor behind ErrorFather slightly modified the malware, but it remains primarily based on the original Cerberus code. "Phoenix," claiming to be a fresh botnet, was found being sold on underground forums. However, it was identified as yet another fork of Cerberus, utilizing its exact source code, whereas Alien and ERMAC had introduced some modifications. It's critical to note that all versions of Siemens Cerberus PRO UL Compact Panel FC922/924 and Siemens Cerberus PRO UL Engineering Tool prior to MP4 are vulnerable to this malware. As a countermeasure, users of these tools should update to MP4 or later versions to mitigate the risk.