Cerberus Unchained: The Multi-Stage Trojan Banking Campaign Targeting Android Devices

The Cerberus Android banking trojan has reemerged in a sophisticated multi-stage attack campaign targeting banking credentials, SMS data, and contact lists of Android users. Known for its stealthy overlay attacks, the campaign mimics legitimate apps, tricking users into providing sensitive information on screens that look identical to trusted apps.

Illustration of the Cerberus Android banking trojan, generated by DALL-E

First detected in 2019, the trojan has since evolved to gain advanced capabilities, including keylogging, remote access, and, most recently, Domain Generation Algorithms (DGAs) for dynamic Command and Control (C2) communications.

The Cerberus malware campaign, also known as ErrorFather, reveals adaptability as it repurposes core functions through a series of droppers, native libraries, and encrypted payloads, effectively bypassing Android’s security defenses. Distributed through Google Play and third-party app stores, Cerberus remains a persistent threat across a broad range of sectors.

The campaign page for Cerberus on SOCRadar XTI platform

Explore information about the campaign and related threats by going to the Campaigns section under SOCRadar LABS. You can also find out how SOCRadar’s XTI platform can improve your proactive security tactics.

Attack Techniques Used by Cerberus

Cerberus’s multi-stage approach relies on several tactics to infiltrate and control devices. The trojan often masquerades as trusted applications like Google Play or Chrome, capturing sensitive data through overlay screens and keylogging. Once deployed, it performs extensive reconnaissance by identifying installed applications, accessing system information, and capturing screen and audio data. The malware’s dynamic C2 communications are encrypted, making detection even more challenging.

Mitigation Measures

Mitigating the Cerberus malware campaign requires comprehensive defense measures, including app verification, endpoint security, and user training. The following are recommended mitigation strategies against known techniques used by the campaign.

Remediation Steps

To remediate devices affected by Cerberus, organizations should deploy tools and policies to monitor and eliminate the malware’s persistent components. Below are key detection and remediation tactics.

Indicators of Compromise (IoCs)

The following IoCs help security teams detect devices compromised by Cerberus. Implement these in threat intelligence feeds to enhance detection and protection.

Conclusion

The Cerberus malware campaign highlights the ever-evolving threat posed by mobile banking trojans. Through advanced techniques such as overlay attacks, keylogging, and encrypted C2 communication, Cerberus presents a persistent danger to Android devices globally. Combatting such sophisticated threats requires a proactive security approach, focusing on multi-layered endpoint protection, app whitelisting, and user training to recognize phishing attempts.

The SOCRadar Extended Threat Intelligence (XTI) platform provides real-time insights into emerging mobile threats, such as Cerberus, allowing for early detection and remediation. Organizations can stay informed and improve their defenses by visiting the Campaigns section under SOCRadar LABS for a thorough overview of current campaigns.