ERMAC V3.0 Banking Trojan Supply Code Leak Exposes Full Malware Infrastructure

Aug 16, 2025Ravie LakshmananAndroid / Malware

Cybersecurity researchers have detailed the internal workings of an Android banking trojan known as ERMAC 3.0, uncovering severe shortcomings within the operators’ infrastructure.

“The newly uncovered model 3.0 reveals a major evolution of the malware, increasing its type injection and knowledge theft capabilities to focus on greater than 700 banking, procuring, and cryptocurrency purposes,” Hunt.io mentioned in a report.

ERMAC was first documented by ThreatFabric in September 2021, detailing its capacity to conduct overlay assaults towards lots of of banking and cryptocurrency apps internationally. Attributed to a risk actor named DukeEugene, it is assessed to be an evolution of Cerberus and BlackRock.

Different generally noticed malware households – together with Hook (ERMAC 2.0), Pegasus, and Loot – possess a shared lineage: An ancestor within the type of ERMAC from which supply code parts have been handed down and modified by means of generations.

Hunt.io mentioned it managed to acquire the entire supply code related to the malware-as-a-service (MaaS) providing from an open listing on 141.164.62[.]236:443, proper all the way down to its PHP and Laravel backend, React-based frontend, Golang exfiltration server, and Android builder panel.

The features of every of the parts are listed beneath –

Backend C2 server – Gives operators the flexibility to handle sufferer gadgets and entry compromised knowledge, resembling SMS logs, stolen accounts, and gadget knowledge
Frontend panel – Permits operators to work together with related gadgets by issuing instructions, managing overlays, and accessing stolen knowledge
Exfiltration server – A Golang server used for exfiltrating stolen knowledge and managing info associated to compromised gadgets
ERMAC backdoor – An Android implant written in Kotlin that provides the flexibility to regulate the compromised gadget and accumulate delicate knowledge based mostly on incoming instructions from the C2 server, whereas guaranteeing that the infections do not contact gadgets situated within the Commonwealth of Unbiased States (CIS) nations
ERMAC builder – A software to assist prospects configure and create builds for his or her malware campaigns by offering the appliance identify, server URL, and different settings for the Android backdoor

Moreover an expanded set of app targets, ERMAC 3.0 provides new type injection strategies, an overhauled command-and-control (C2) panel, a brand new Android backdoor, and AES-CBC encrypted communications.

“The leak revealed important weaknesses, resembling a hardcoded JWT secret and a static admin bearer token, default root credentials, and open account registration on the admin panel,” the corporate mentioned. “By correlating these flaws with stay ERMAC infrastructure, we offer defenders with concrete methods to trace, detect, and disrupt energetic operations.”