Data by Hatching Triage Android

Alien

Alien is an Android banking trojan operated as a malware-as-a-service offering and derived from the Cerberus v1 codebase.

Profile source: Mallory

Alien

Family profile

Alien is an Android banking trojan operated as a malware-as-a-service offering and derived from the Cerberus v1 codebase. First observed in 2020, it is associated with financially motivated Android fraud operations and has been distributed through staged Google Play dropper campaigns masquerading as legitimate utility, scanner, cryptocurrency, and fitness applications. These droppers can selectively deliver the payload and solicit installation of a purported update from unknown sources.

Alien abuses Android Accessibility Services to support overlay-based credential theft and can collect SMS messages, notifications, contacts, device information, installed-application inventories, location data, and Google Authenticator secrets used for two-factor authentication. It supports keylogging, SMS harvesting and forwarding, call forwarding, USSD requests, arbitrary web-page display, application installation, launch and removal, screen locking, and remote access functions implemented through TeamViewer-based functionality. It also includes modularity, auxiliary command-and-control resilience, application-icon hiding, removal prevention, and emulator detection.

Alien has been linked to the commercial-surveillance ecosystem surrounding Cytrox/Intellexa. In limited 2021 Android exploit campaigns attributed to government-backed Cytrox customers, Alien was deployed following spearphishing-led Chrome and Android exploit chains and used as a precursor to load the Predator spyware implant. Alien's Cerberus lineage and its overlap with later Android banking malware development contributed to its prominence after Cerberus operations declined and its source code was leaked.

Capabilities

Credential Theft
Defense Evasion
Exfiltration
Keylogging
Persistence
Post Exploitation

Reported operators

Threat actors

4 named in public reporting

Brunhilda Project

Initially, the Brunhilda droppers were deploying a variety of Android malware applications, like for example samples of the malware family Alien.

Cytrox

The ultimate goal of the operation, the researchers assessed, was to distribute a malware dubbed Alien, which acts as a precursor for loading Predator onto infected Android devices.

Brunhilda

Some samples were observed having more than 50.000+ installations, and dropping the android trojan Alien.

Intellexa

Predator от Cytrox / Intellexa работает двухкомпонентно: Alien ломает устройство, Predator устанавливает модули слежки.

Exploited software

Vulnerabilities linked to Alien

5 CVEs

CVE-2021-1048 Use-After-Free Privilege Escalation in Android Kernel eventpoll CVE-2021-37976 Information leak in Google Chrome memory instrumentation CVE-2021-38000 Insufficient validation of untrusted input in Intents in Google Chrome on Android CVE-2021-38003 V8 exception-handling flaw leading to renderer RCE in Google Chrome CVE-2021-37973 Use-after-free in Google Chrome Portals

MITRE ATT&CK

Alien in ATT&CK

48 distinct techniques

Techniques

48 techniques

T1505.003 Web Shell T1105 Ingress Tool Transfer T1548 Abuse Elevation Control Mechanism T1219 Remote Access Tools T1071.001 Web Protocols T1611 Escape to Host T1082 System Information Discovery T1528 Steal Application Access Token T1033 System Owner/User Discovery T1056 Input Capture T1553.004 Install Root Certificate T1566.002 Spearphishing Link T1497 Virtualization/Sandbox Evasion T1036 Masquerading T1614 System Location Discovery T1185 Browser Session Hijacking T1564 Hide Artifacts T1090 Proxy T1055 Process Injection T1068 Exploitation for Privilege Escalation T1056.001 Keylogging T1546.008 Accessibility Features T1562 Impair Defenses T1123 Audio Capture T1189 Drive-by Compromise T1203 Exploitation for Client Execution T1071 Application Layer Protocol T1518 Software Discovery T1204 User Execution T1497.001 System Checks T1218 System Binary Proxy Execution T1620 Reflective Code Loading T1059 Command and Scripting Interpreter T1057 Process Discovery T1090.001 Internal Proxy T1078 Valid Accounts T1021 Remote Services T1027 Obfuscated Files or Information T1021.004 SSH T1190 Exploit Public-Facing Application T1570 Lateral Tool Transfer T1555 Credentials from Password Stores T1132 Data Encoding T1059.006 Python T1649 Steal or Forge Authentication Certificates T1083 File and Directory Discovery T1005 Data from Local System T1574.006 Dynamic Linker Hijacking

Reporting

Research mentioning Alien

Jan 1

Intel471

ERMAC 2.0: Perfecting the Art of Account Takeover | Intel 471

ERMAC evolved into a more capable Android banking trojan that abuses Accessibility Services to steal credentials, intercept SMS codes, and capture Google authentication tokens, allowing attackers to bypass multi-factor authentication and take over banking, financial, ecommerce, and cryptocurrency accounts. Researchers said ERMAC 2.0, derived from leaked Cerberus code and sold through the malware-as-a-service ecosystem, expanded its targeting from 378 applications to 467 and used encrypted communications, phishing overlays, and app-list reconnaissance to fetch tailored injection content from command-and-control servers. The malware was distributed through fake browser update pages, phishing sites impersonating brands such as Bolt Food, trojanized Android apps, and Google Play dropper applications that helped infect more than 300,000 devices across multiple banking trojan campaigns. ThreatFabric also linked ERMAC delivery to the Zombinder app-binding service, which hides malicious payloads inside working Android apps, and observed overlapping infrastructure that also pushed Windows malware including Erbium Stealer, Laplas Clipper, and Aurora Stealer, underscoring a broader criminal ecosystem built around outsourced obfuscation, staging, and malware delivery.

Dec 8

Threatfabric