Cerberus Unchained: A Multi-Stage Trojan Banking Campaign
Indicators of Compromise
No domains found for this campaign
Campaign Guidance
Remediation, mitigation, notes, history and related intelligence
Tactic | Technique ID | Remediation |
Initial Access | Phishing (T1660) | Implement email filtering with advanced threat detection, conduct regular phishing awareness training, and enforce MFA. |
Execution | Native API (T1575) | Employ application whitelisting to prevent unauthorized use of APIs, and monitor API calls for abnormal behavior. |
Defense Evasion | Masquerading: Match Legitimate Name or Location (T1655.001) | Use application verification tools and enforce strong app store policies. Monitor for unusual app behaviors. |
Defense Evasion | Application Discovery (T1418) | Implement endpoint detection and response (EDR) solutions to block suspicious app discovery activities. |
Defense Evasion | Indicator Removal on Host: Uninstall Malicious Application (T1630.001) | Use mobile device management (MDM) solutions to detect and block unauthorized app uninstalls. |
Defense Evasion | Input Injection (T1516) | Monitor input injection behaviors, use app sandboxing to restrict permissions, and update security patches regularly. |
Collection | Input Capture: Keylogging (T1417.001) | Use anti-keylogging software, implement strict app permissions, and audit access to sensitive data. |
Discovery | Software Discovery (T1418) | Deploy endpoint protection to detect and block unauthorized software discovery attempts. |
Discovery | System Information Discovery (T1426) | Limit app access to system information, enforce app permission policies, and monitor requests for device info. |
Collection | Screen Capture (T1513) | Restrict apps’ screen capture permissions, use EDR to monitor screen capture attempts, and limit third-party screen tools. |
Collection | Audio Capture (T1429) | Enforce microphone access restrictions, use MDM to block unauthorized audio capture, and audit permissions regularly. |
Collection | Call Control (T1616) | Limit app access to call-making features and monitor for unauthorized call activities through MDM. |
Collection | Protected User Data: Contact List (T1636.003) | Encrypt contact data, apply least privilege access for apps, and monitor apps requesting contact access. |
Command and Control | Dynamic Resolution: Domain Generation Algorithms (T1637.001) | Use DNS filtering to detect and block suspicious domain generation, and analyze network traffic for anomalies. |
Command and Control | Encrypted Channel: Symmetric Cryptography (T1521.001) | Monitor encrypted traffic with deep packet inspection (DPI) and use IDS to detect anomalous encrypted communications. |
Exfiltration | Exfiltration Over C2 Channel (T1646) | Deploy data loss prevention (DLP) solutions to monitor and block suspicious data exfiltration attempts. |