The “Cerberus” Android Malware Is Offered for Purchase at $100,000

• Cerberus is for sale, but buying the project and running it would be more complicated than it sounds.
• The price was set at $50k, but the auction will immediately close if anyone offers $100k.
• Cerberus has been very successful so far, but the end of its good run may be approaching.

The authors and maintainers of the “Cerberus” banking trojan are auctioning the project along with the source code and everything that the buyer will need in order to exploit Android users out there. The starting price was set at $50,000, but anyone offering double the amount will immediately control the project. The seller is even including their customer list, installation guides, automating scripts, and more.

The bank info-stealing trojan was previously rented for $12,000 per year or $4,000 per quarter.

According to information in dark web forums, Cerberus is making $10,000 per month profit, so the seller could make this money in less than a year. For some reason, though, the author decided to get rid of Cerberus right now.

One could be their desire to move out of the illegal scene and the risk of finding trouble, another could be that they want to focus on the development of a new and more lucrative project, and a final one could be that the crew had internal conflicts and they no longer wish to collaborate in harmony.

Related: Cerberus Was Found Lurking on the Google Play Store

Whatever the case, Cerberus is for sale, and the price tag is a good one. Of course, aspiring young hackers and smaller groups of malicious actors won’t have the resources to get their hands in this sophisticated malware piece, so the target is to attract interest from established and renowned threat actors. Even then, the buyers would have to decide if they’ll maintain the “rented service” character of Cerberus, which would mean to offer 24/7 support.

Using Cerberus to target big players wouldn’t be a logical approach, and advanced actors have their own set of custom malware for this job. All that said, buying Cerberus isn’t automatically going to make anyone rich, and it holds risks on multiple levels.

First, they can never be sure that the source code won’t be shared with others after they make the purchase. Secondly, this is not a legal piece of software or project, so buying it may lead to law enforcement authorities tracking their real identity. Thirdly, a new and better “banking malware as a service” may come out any time, rendering Cerberus “old news”. Suddenly, that $100k doesn’t look like a bargain, although it’s still a fair price considering the current status of the scene and the capabilities of the malware.