MDM to MitM – Multinational’s mobile endpoints engulfed by Cerberus banking trojan

guest · May 5, 2020

Multinational’s mobile endpoints engulfed by Cerberus banking trojan
Compromised MDM server becomes vector for widespread malware campaign
May 5, 2020
https://portswigger.net/daily-swig/...endpoints-engulfed-by-cerberus-banking-trojan

Attackers recently compromised more than 75% of a multinational conglomerate’s mobile devices with a new variant of the Cerberus Android banking trojan, security researchers have revealed.

Upon gaining entry to the corporate network via the Mobile Device Manager (MDM) server, miscreants stole passwords and 2FA credentials, according to a blog post published by Check Point on April 29.
They also discovered that the new malware variant had mobile remote access trojan (MRAT) capabilities such as keystroke logging, SMS stealing, Google Authenticator data interception, and even the ability to command the device remotely via TeamViewer.

From the infection’s rapid spread, the team of eight researchers theorized that propagation was automated, with the malware either moving laterally or via the customer’s MDM. The customer later confirmed the latter was true.
Click to expand...

Expensive lesson to learn
To expunge all malware traces the victim company applied a company-wide factory reset of devices – an “extremely costly” exercise given the need for damage assessment and subsequent re-establishment of the entire mobile network, Check Point noted.

They concluded that the incident underscores the importance of distinguishing between managing and securing mobile devices.
Click to expand...

Check Point Research: First seen in the wild – Malware uses Corporate MDM as attack vector

Check Point researchers discovered a new Cerberus variant which is targeting a multinational conglomerate, and is distributed by the company’s Mobile Device Manager (MDM) server. This malware has already infected over 75% of the company’s devices. Once installed, this Cerberus variant can collect large amounts of sensitive data, including user credentials, and send it to a remote command and control (C&C) server.
Click to expand...

Log in or Sign up

MDM to MitM – Multinational’s mobile endpoints engulfed by Cerberus banking trojan

guest Guest

Log in or Sign up

MDM to MitM – Multinational’s mobile endpoints engulfed by Cerberus banking trojan

guest Guest

Useful Searches