Executive Summary
ERMAC and HookBot are two branches of one Android banking trojan sold as a service. They forked from a shared code base and each evolved in the direction its developers took it, but the core they run is close enough that a single constant in the source decides which name the panel shows. A copy of the builder, the Laravel backend, and the React panel leaked in August 2025. In the deployments whose configuration we could read, the credentials, keys, and ports that shipped with the code are still in place.
The lineage can be read in the source. ThreatFabric and NCC Group argued the Cerberus-to-ERMAC-to-Hook line from how samples behaved, which is an inference from the outside. All three code bases are now available, so the inference can be checked against the code, and it holds. Cerberus C2 network request type objects map one-to-one onto ERMAC 3.0 controller methods, and structural correspondence at that level is not something two teams arrive at independently: it is what a developer leaves behind when they start from someone else’s tree. The same base64-and-encrypted-body protocol carries across generations with only the cipher changing, and ERMAC 3.0 matches HookBot down to 21 database migrations sharing a timestamp. A panelName constant reads "ERMAC" in one tree and "Hook" in the other, which is why two live properties carry Censys labels for both families on the same page. HookBot also ships an IP-whitelist firewall and a Telegram bot that the ERMAC tree lacks.
The firewall misses the builder. HookBot ships an IP-whitelist firewall that drops inbound traffic to the panel, the API, and the implant socket. It does not cover the builder port, so the component that stays reachable is the one still worth scanning for.
The target list is worldwide. The overlay list bundled with the leaked panel software names 484 apps across more than 40 countries: Japanese banks and wallets, Brazilian and Turkish banks, and over 30 cryptocurrency wallets. It is the operator’s own configuration rather than a vendor estimate, and it contains no victim data.
Hunt the builder rather than the panel. Over the past year Censys observed 266 distinct HookBot-labeled IPs against 55 for ERMAC. HookBot peaked at 58 active hosts in September 2025, the month after the source was published, then fell to 6 by June 2026 as operators enabled the gate. Panel titles and favicons are precise, but a title costs one line to change and a gated panel is invisible to passive scanning. The builder ships 13 obfuscator flags that cannot be renamed without breaking the build, on a port the firewall never covers.
What follows starts with how these trojans work and what the panel is for, then covers where the family came from and how the source got out, what the operators left behind in the code, and which detection artifacts survive contact with an operator who is paying attention.
Background: Two Halves of One Business
Someone opens their banking app. The login screen looks right, so they type their password. It is a picture of the login screen, drawn on top of the real app a half-second after it launched, and the password goes to whoever is renting the panel that month. When the bank texts a confirmation code, the phone forwards that too.
Pulling this off takes two pieces of software. The implant is the app on the phone. It gets installed because someone was told to install it, and it asks for Android accessibility permissions, which exist so screen readers can operate other apps. Granted to malware, they mean it can watch every screen and act on it. The fake login is called an overlay, and the operator needs a hand-built one per app they want to rob. When this piece counts 484 or 700+ “targets,” those are prepared fake screens, not victims.
The panel is the web application the criminal logs into. It lists the infected phones, collects what they steal, holds the overlay library, and pushes commands back down. In this family it also has a builder that stamps out fresh implant APKs on request. The business sells access to the panel: rent one, build implants, distribute them yourself. ThreatFabric’s 2019 write-up of Cerberus describes the rental model this family grew out of.
Distribution is the customer’s problem, and they solve it by side-loading instead of going through the Play Store. Fake update pages, links to an APK, GitHub used as file hosting, Telegram channels. The lures wear real brands: ERMAC v1 in Poland posed as Chrome, the DPD delivery app, and the government’s mObywatel, while Hook went global with lures spanning banks, retailers, and crypto services. Netcraft catalogued that impersonation campaign across roughly 460 brands. Hook can also send the link from an infected phone’s own WhatsApp, so it arrives from a friend, though the recipient still has to tap through an APK install and hand over accessibility permissions.
The HookBot source shows the disguise is a menu. Its manifest carries 20 activity-aliases with icons and labels for Chrome, WhatsApp, Instagram, Telegram, TikTok, Facebook, Gmail, Google Play, Youtube, and Contacts, and the operator picks which one the launcher icon becomes.
The rest of this piece is about servers, for a practical reason. Every implant is obfuscated at build time, so no two are alike and their hashes track nothing. The panel cannot hide the same way, because infected phones have to reach it and customers have to log into it. It has an address, open ports, and a favicon. Everything below about ports, credentials, and firewall rules concerns that machine, and every host count is a panel rather than a victim.
The Family
The lineage runs Cerberus to ERMAC to Hook. The Cerberus here is the Android banking trojan ThreatFabric documented in August 2019, rented on Russian-language forums and unrelated to the several security products, ransomware strains, and botnets that share the name. Its authors put the whole project up for auction in July 2020, opening at $50,000 with a $100,000 buy-now, found no taker, and published the code free to premium users of a Russian-speaking forum that September.
ERMAC, built on that leaked code, first appeared in July 2021. Hook arrived in January 2023, advertised by its developer (“DukeEugene”) as written from scratch. ThreatFabric and NCC Group both looked at the code and disagreed: all 30 ERMAC operator commands were present in Hook with nearly identical implementations. Hook added roughly 38 commands, most notably remote screen control via VNC. NCC Group identifies two handles behind Hook: DukeEugene, the developer and advertiser, and RedDragon, the coder.
Researchers found an operator’s own deployment sitting in an open directory in March 2024. Roughly 18 months later, in August 2025, that copy was published: the Laravel backend, the React frontend panel, the WebSocket relay, the APK builder, and the bundled Obfuscapk obfuscator. Publication is what put it in general circulation, and the vx-underground project mirrored it. The leak means anyone can stand up a panel now, and the panel artifacts are shared across unrelated operators rather than tracing to one crew.
We observed the lineage directly. Two web properties, havijmail[.]com and www.racon[.]online, carried Censys threat labels for both ERMAC and HookBot on the same page, titled ERMAC 3.0 PANEL, on 15 and 16 August 2026 respectively. Both served byte-identical HTML.
A page carrying two family names is unusual. Censys applies a threat label when a scanned service matches a fingerprint, which is a hand-written rule keyed on concrete artifacts: a page title, the hash of a favicon, a string in the response body, a header. The ERMAC fingerprint and the HookBot fingerprint were written separately, from different samples, and neither one references the other. Both fired on these pages anyway. When two rules built from what were assumed to be two families both match one server, the likeliest explanation is that the underlying software is shared, which is what the source code then confirmed.
The panel name is a single constant. The ERMAC 3.0 source sets it to "ERMAC"; the HookBot source sets the same line to "Hook". Changing one string rebrands the panel, which accounts for how freely titles vary: ERMAC 3.0 PANEL, HOOKBOT PANEL, and the mangled forms E.R.M.V.C and ERMVK PVNEL that the ERMAC fingerprint already matches. Defeating title detection costs an operator one line.
From Cerberus to ERMAC: What the Source Shows
The Cerberus source (also on vx-underground) confirms the lineage at the code level. Its REST API accepted base64-encoded JSON and switched on request types: getBots, botsSetCommand, deleteBots, mainStats, editComment. ERMAC 3.0 rebuilt the same API in Laravel with the same operations under different names: getBotsList, sendBotsCommand, deleteBot, getStats, editBotComment. The protocol structure stayed the same, with its base64 POST body, encrypted payload, and request-type switch. Only the cipher changed, from RC4 to AES-128-CBC.
Any two people building a botnet panel will need to list bots, send them commands, and delete them, so overlap in what the operations do proves nothing. The correspondence in how they are organized is harder to explain by coincidence: the same set of operations, at the same granularity, sliced the same way, with an edit-comment function sitting at the same level as bot deletion. A developer writing from scratch makes different choices about where to draw those lines. A developer working from an existing tree inherits them, renames things to suit the new framework, and moves on. The renaming is itself the signature, because a clean-room reimplementation has no reason to preserve the shape while changing the labels.
Behavioral analysis of samples produces a well-supported judgment about shared ancestry. Reading both code bases turns that judgment into something checkable, and it sharpens where the ancestry stops: the operator lineage below does not follow the code lineage, and only the source makes that separation visible.
The habit of shipping working credentials carries across generations too. Cerberus hardcoded admin credentials in its panel; ERMAC 3.0 seeds them in DatabaseSeeder.php, and HookBot ships the same seeder. It is another inherited shape, and one more reason to read the two trees as one line of development.
The Operator Behind the Code
Two separate lineages run through this family, and they are easy to collapse into one. The code lineage runs Cerberus to ERMAC to Hook to the post-Hook ERMAC that absorbed Hook’s code. The operator lineage runs LokiBot to Xerxes to BlackRock to ERMAC to Hook. They meet at ERMAC and nowhere earlier.
DukeEugene operated BlackRock from May 2020. BlackRock is not a Cerberus fork: ThreatFabric traced it to Xerxes, itself descended from Parasite, MysteryBot, and ultimately LokiBot, whose author released the code publicly after failing to sell it. BlackRock shares the operator with ERMAC, not the code. When BlackRock was discredited (a buyer rebranded it “AmpleBot” and scammed people), DukeEugene switched to the leaked Cerberus code and built ERMAC. ThreatFabric assessed that “DukeEugene switched from using BlackRock in its operations to ERMAC,” noting no fresh BlackRock samples after ERMAC surfaced and shared C2 infrastructure in the same 185.215.113.* range.
Two handles sit behind Hook, not one. NCC Group identifies DukeEugene as the developer and advertiser, and RedDragon as the coder. RedDragon, not DukeEugene, posted the $70,000 source sale on 17 April 2023. DukeEugene announced the shutdown two days later, on 19 April, citing “leaving for special military operation,” a reference to the war in Ukraine. The operators were Russian-speaking. The Turkish-language “Maganda” panel in the Cerberus source is a dealer-management layer sitting over a Russian-language admin backend, not evidence the operators themselves were Turkish.
That dealer layer shows the business was not a flat rental. Its pages are titled Alt Bayiler Listesi and Alt Bayi Ekle, meaning “sub-dealers list” and “add sub-dealer.” A dealer here is a reseller: someone who buys access wholesale from the malware’s owners and rents it on to their own customers, the way a distributor sits between a manufacturer and a shop. The owners run the top-level panel, dealers run their own operations underneath, and each dealer’s customers never deal with the owners directly.
The form for adding one records what the tier consists of. Each dealer row holds a private key, a contact handle, server details, a domain, an API crypt key, and a subscription expiry date. A dealer arrives with their own infrastructure and their own encryption key, and the owners track when their access lapses. The owners sell the software and the brand, the dealer supplies the servers and finds the customers, and the money moves up through a tier the end user cannot see. It also explains the language split, since a Turkish-speaking reseller organization would want its own interface over a product built by Russian speakers.
From ERMAC 1.0 to the Leak
The version progression is a story of a widening target list, a rising price, and a single capability leap at Hook.
| Version | First seen | Price | Target apps | Campaign focus | Notable change |
| Cerberus | Aug 2019 | ~$2,000/mo (unverified) | ~30 | FR, US, JP banks | The progenitor; RC4, .onion, raw PHP |
| ERMAC 1.0 | Jul 2021 | $3,000/mo (10 renters) | 378 | Poland (Chrome, DPD, mObywatel) | Built on Cerberus; Blowfish string encryption, AES-128-CBC C2 |
| ERMAC 2.0 | May 2022 | $5,000/mo | 467 | Poland (Bolt Food, fake browser updates) | Bundled with desktop stealers via the Zombinder service |
| Hook | Jan 2023 | $7,000/mo | 430+ (460 per Netcraft) | Global; Turkey, Spain, Poland, Portugal top targets | +38 commands incl. VNC, file manager, WhatsApp; worm-like spread via openwhatsapp |
| ERMAC (post-Hook) | timing uncertain (see below) | – | 700+ | Post-leak, multi-operator | Absorbs Hook code; Laravel+React+Docker; Obfuscapk builder |
Public reporting records little between ERMAC 1.0 and 2.0 beyond the target list growing from 378 to 467 and the Zombinder bundling with desktop stealers. The real leap comes at Hook, where the command set grew from 30 to 58 in v1 and 68 in v2, adding VNC remote control, a file manager, WhatsApp manipulation, and a self-propagation command (openwhatsapp). ERMAC later absorbed that Hook code back into its own line. Intel 471 reported an “ERMAC 2.0: Perfecting the Account Takeover” release in August 2022, but the report is no longer fetchable, so the timing of the reabsorption rests on that single source.
The 484 overlays shipped with the leaked panel are a subset of the 700+ target list, since not every targeted app gets one. They span more than 40 countries: Japanese banks and wallets (PayPay, Rakuten, SMBC, Coincheck), Brazilian banks (Bradesco Next, Intermedium, Modalmais, Original), Turkish banks (Akbank, Garanti, Yapi Kredi, QNB Finansbank), and over 30 crypto wallets (MetaMask, Trust Wallet, Coinbase, Binance, Samourai, Mycelium, SafePal). The spread confirms what the public “700+ apps” figure implies about a global commercial operation. The tables that would hold victim records in a working deployment are empty in this copy, so the target list is targeting intent, not evidence of who was hit.
How the Three Differ
Cerberus is the outlier, and this table compares panels, not implants. The Cerberus panel ran raw PHP with the Medoo database wrapper on an .onion hidden service, and its server encrypted implant traffic with RC4. The ERMAC 3.0 and HookBot panels share a Laravel + React + Docker Compose core with AES-128-CBC, down to a crypto key and initialization vector that are identical across the two code bases, both carried over from .env.example untouched. The key is a well-known placeholder.
Whether a given operator changed those values is a separate question, and one we cannot answer at scale. The relay key and IV live in a server-side .env file that passive scanning never sees, so the only deployments we can speak to are the ones whose configuration was recovered, and in those the shipped values survive. A careful operator could edit them in a minute. The point is not that every panel in the wild uses the placeholder, but that the software ships ready to run without anyone being prompted to change it, and at least some operators take that path.
The remaining differences sit at the edges, in the last three rows below.
| Feature | Cerberus | ERMAC 3.0 / HookBot |
| Backend | Raw PHP + Medoo | Laravel 10 + Eloquent |
| Frontend | PHP template | React + TypeScript |
| Cryptography | RC4 | AES-128-CBC |
| Deployment | .onion only | Clearnet + Docker |
| Builder | public/builder/ | Dockerized builder/app/ |
| Admin panel | “Maganda” (Turkish) | panelName constant – "Hook" or "ERMAC" |
| Session cookie | restApiUrl | hook_session (HookBot), ermac_session (ERMAC) |
| Telegram bot | No | HookBot only (ASP.NET) |
| Security gate | No | HookBot only (security/) |
ERMAC 3.0 is a direct fork of HookBot. The ERMAC tree still carries Hook-named source directories and the same 21 database migrations to the timestamp. The only meaningful changes are the panelName constant, the removal of Telegram routes, and a relay rewrite in a different language.
Timeline
The version table above covers the family’s first half: Cerberus leaks in 2020, ERMAC ships, Hook forks and shuts down, the source is sold. What pivots the story is the ERMAC 3.0 source becoming widely available, first through an open directory found in March 2024 and then through publication in August 2025. After that, the operators are no longer one crew.
Three events carry the second half:
- June 2023 – The builder tree’s initial git commit is dated 21 June 2023 at 20:29 UTC, authored as
kalion aEurope/Moscow(+0300) host. The date falls between Hook’s shutdown and the ERMAC 3.0 leak, consistent with the original operator’s development cycle rather than a post-leak reassembly. - March 2024 – An open directory holding a deployed copy of the ERMAC 3.0 panel, builder, and backend is left exposed and found by researchers. It would not be written up publicly for another 18 months.
- August 2025 – That copy is published, and vx-underground mirrors it. Publication drops the barrier to standing up a panel to near zero.
The code lineage and the operator lineage diverge after August 2025. A recovered deployment shows a different hand adapting the leak: a relay rewritten in another language, commented in Chinese, layered over the original Russian-authored base, with a test account in the operator table alongside the seeded defaults. Its builder produced APKs in June 2026. The stack was still under active development nearly a year after the source went public, and no longer by the crew that wrote it.
The Stack
Both panels run the same Docker Compose core. The ERMAC version names its containers ermac3__panel_* and the HookBot version names them hook__panel_*; below that naming, the services and their ports match.
| Container | What it does | Published port |
| nginx | Front door: serves the React panel, proxies the API and builder | 80 (panel), 8089 (API), 8088 (builder) |
| php | Laravel 10 backend (PHP 8.1, JWT + Sanctum) + Workerman socket | 8000 (socket) |
| node | Builds the React frontend | (build only) |
| mysql | MySQL 8.0, stores bots, logs, injections | 3306 |
| golang | WebSocket relay (implant-facing C2) | 3434 |
| builder | APK builder with Obfuscapk and apktool | 8088, 9090 |
| phpmyadmin | Database admin, proxied at /mssql/ | (via nginx) |
The golang container is named for a language it no longer runs. The relay that ships in the recovered stack is server.js, a Node.js reimplementation using the ws library, with two superseded Go binaries sitting alongside it. Its comments are in Chinese, while the readme, sample values, and timezone of the surrounding code are Russian. Of the evidence that the leak changed hands, this is the least ambiguous.
The port map matters for detection. On a host running this stack, :8089 is the Laravel API, :8088 is the builder, :8000 is the Workerman socket that faces the implants, :3434 is the WebSocket relay, and :3306 is MySQL. These ports are baked into docker-compose.yml, and they recur across deployments because operators do not change them. They remain defaults rather than guarantees: at least one observed cluster exposes :8080 directly, which the shipped map does not do.
The HookBot tree adds two components the ERMAC 3.0 dump does not have.
The backend routes are under /api/v1/. Every protected route sits behind auth:sanctum except the smart-injection group, which is declared as a sibling of that middleware group rather than inside it. Infected devices post there without operator credentials, so any unauthenticated caller can read and write injection-session records. The implant-facing edge of the API has to accept anonymous traffic, but it exposes more than the job requires.
The Security Gate
The HookBot source ships a security/ component absent from the ERMAC open-directory dump. It works as an IP-whitelist firewall, and it accounts for panels disappearing from passive scans.
install.sh creates iptables rules that DROP all inbound connections to ports 80, 8089, and 8000 unless the source IP is in an ipset allowlist:
iptables -I DOCKER-USER -i ens3 -m set ! --match-set whitelist src -p tcp --dport 80 -j DROP
iptables -I DOCKER-USER -i ens3 -m set ! --match-set whitelist src -p tcp --dport 8089 -j DROP
iptables -I DOCKER-USER -i ens3 -m set ! --match-set whitelist src -p tcp --dport 8000 -j DROPA visitor authenticates to a small Express app on :50000 with HTTP basic auth. The default credentials are hardcoded in the source. On success, the app runs ipset add whitelist <ip> and schedules removal after 12 hours. The :50000 endpoint returns PROTECTED AREA on a 401, which is a distinctive response string for detection.
The rules cover 80, 8089, and 8000, where the builder runs, so an operator who installs the gate hides the panel, the API, and the implant socket while leaving the builder answering anyone who asks.
The effect shows up across scan passes. Three hosts on one cluster served HOOKBOT PANEL on :50555 from July 10th, 2026. By the August scan that port was gone, and the labels stopped appearing after 13 August, though the hosts still answered on :80 with an nginx error body, on :888 with a 403, and on :8080 with a 426 Upgrade Required, which is a WebSocket asking for a protocol upgrade. ThreatFox continued to report :50555 as live. Both readings are correct: the port stays open to allowlisted IPs and closed to everyone else. A panel that disappears between scans has not necessarily gone down.
The Telegram Bot
The HookBot version adds an ASP.NET application (asp.net/TelegramInjectionBot) that runs alongside the Laravel backend. It connects to the same MySQL database and runs six workers:
InjectionToTelegramWorker– forwards injection sessions to the operator via TelegramCheckNewBotLogsWorker– monitors for new stolen dataCheckOfflineBotsWorker– alerts when bots go offlineHandleTelegramMessagesWorker– processes operator commands from TelegramSendUserAuthorizationCodesToTelegramWorker– forwards 2FA codesSendNewMessagesWorker– forwards intercepted SMS
Telegram is the operator’s primary interface. They can monitor infections, receive stolen credentials and 2FA codes in real time, and send commands to bots, all from a chat window. The Laravel panel is a management backend.
The source ships with hardcoded Telegram bot tokens and a MySQL root password. The tokens share a bot ID but have different secrets, suggesting the operator rotated the token between development and deployment. These are not published here.
What Works for Detection and What Does Not
| Artifact | Precision | Durability | Note |
Builder obfuscator flags (ch_*) | High | High | 13 co-occurring strings; renaming breaks the build |
Security-gate :50000 auth | High | High | Returns PROTECTED AREA on 401; hardcoded in source |
| Panel favicon MD5s | High | Medium | One host each, zero benign matches; rotates on rebrand |
| Panel body hashes | High | Low | Exact match, dies on any edit |
| Panel titles | High | Low | One constant to change; already mangled in the wild |
:50555 port | Low | Low | Reported but not observable when the gate is on |
workerman/4.1.9 banner | Very low | n/a | 91 hosts internet-wide, mostly Chinese cloud |
The favicon sets are the strongest passive signal. As of the August 2026 pass, each returned exactly one host internet-wide with no benign matches: 0452650b0b1e7eeaf01bd74e927a4dd7 (ERMAC) hit only havijmail[.]com, and 90a61dcc76d704b2e861a0465ced2f87 (HookBot) hits only vps-d798fb0f.vps.ovh[.]net. Body hashes are equally precise but break on any edit. Titles are precise and trivial to change, which is why the shipped ERMAC fingerprint already anticipates mangled forms.
The workerman/4.1.9 banner is the family’s own C2 listener. The stack requires it in backend/composer.json and starts it from supervisord.conf with php artisan sockets start daemon. But 91 hosts run it internet-wide, 47 of them on Tencent, so it is too common to detect on alone.
The hook_session cookie is a strong signal in principle. The fingerprint’s second clause matches Set-Cookie: hook_session=... anchored at the start, which avoids unrelated Laravel apps whose session cookies merely contain “hook” as a substring. The anchor is not enough on its own, though. Cookie name alone is not specific enough for a family whose name is a common English word, and the clause should require a second anchor, such as a favicon, body string, or title pattern, to avoid matching shared-hosting boxes that simply have “hook” in a hostname.
The builder’s obfuscator flags hold up best. The builder ships 13 co-occurring ch_* strings from the bundled Obfuscapk obfuscator, and renaming any of them breaks the build pipeline. Port :8088 sits outside the security gate, so the flags stay visible after the panel goes dark. The gap in the firewall’s coverage is what keeps that signature reachable.
Hosting Over Time
The hosting data tells the story in two curves. Both threats have been continuously present for a full year, August 2025 through August 2026, but the shape differs.
A note on method, because it bounds what these numbers mean. Each month’s figure is the count of distinct IPs scanned that month carrying the threat label, over a 365-day window. A host that persists across several months is counted in each one, so the monthly figures do not sum to the yearly total.
Across the year Censys observed 266 distinct HookBot-labeled IPs against 55 for ERMAC, close to five to one. The HookBot curve has a clear peak. The number of active hosts climbs from 35 in August 2025 to 58 in September 2025, the month after the ERMAC 3.0 source was published, then declines through the winter to a low of 6 in June 2026. The August 2025 source publication is the inflection: the barrier to standing up a panel dropped, new operators tried it, and then the security gate and takedowns pulled the count back down. The July-August 2026 uptick, 9 then 16, tracks two clusters re-emerging.
ERMAC stays low and flat, between 2 and 13 hosts all year, with no surge tied to the leak. ERMAC-labeled infrastructure is the shrinking tail, and operators present as HookBot. The two live ERMAC 3.0 PANEL properties (havijmail[.]com, www.racon[.]online) are Cloudflare-fronted and appear for a single observation each in mid-August 2026; the persistent ERMAC hosts are direct IPs. The longest-lived is 137.220.219[.]244 on CTG, labeled across 63 days between February 24th and May 11th, serving several hostnames including ces.yeyr[.]lol and errr.onllee[.]com.
HookBot panels are short-lived and high-churn. Many appear for a single observation and vanish, consistent with the security gate filtering scanner IPs between Censys passes. The port signature across them matches the stack’s published ports, which is why the same 80/8089/50555 pattern recurs.
Infrastructure
Infrastructure spreads across small hosters, not one bulletproof provider. AS152194 CTG Server Limited is the most persistent, carrying hosts for both family labels from February through August 2026. AEZA (AS210644) has hosted a builder since 9 July 2026, still live at publication. Cloudflare fronts both ERMAC panels, hiding origin. The two clusters active in August 2026 show the range: the CTG hosts gated and serving nothing a scanner can index after 13 August, and three cognetcloud hosts on AS401701 fully exposed from 17 August, with HOOKBOT PANEL on :50555, the Laravel API on :8089, and the Workerman socket on :8000.
Get 2026 Adversary Infrastructure Trends
Each year, Censys’ State of the Internet Report analyzes Internet-wide trends to identify meaningful shifts in the infrastructure, technologies, threats, and behaviors shaping the public Internet. Sign up to get your copy when it publishes this October.
Outlook
The visible panel count will keep falling. The hosting curve shows the shape: a September 2025 peak after the source publication, then a decline as the security gate makes panels invisible to passive scanners by default. Panel-title and favicon detection covers a shrinking share of the real infrastructure, and the builder flags are what remains stable.
The WebSocket endpoints resist passive fingerprinting. , whether the relay sits on its default :3434 or on a port an operator has moved it to. The relay uses ws library defaults with no custom subprotocol, and the implant’s first frame is AES-128-CBC ciphertext. Its one distinctive behavior, a server-initiated ping every 30 seconds, only shows up if you hold a connection open. Confirming it would take active probing, so we have not treated it as a fingerprint candidate.
ThreatFox :50555 reporting for this family should not be trusted without verifying the port is observable. In both August clusters, it was not.
Indicators of Compromise
All indicators are defanged. Credentials, keys, and bot tokens recovered from the source are deliberately excluded.
Active windows are the first and last date Censys observed the host carrying a family threat label. A single date means the host was seen once.
Panels and Delivery Infrastructure
| Type | Indicator | Family | Active window | Notes |
| domain | havijmail[.]com | ERMAC | 2026-08-15 | ERMAC 3.0 PANEL on :80; Cloudflare-fronted; dual-labeled ERMAC and HookBot; single observation |
| domain | www.racon[.]online | ERMAC | 2026-08-16 | ERMAC 3.0 PANEL on :80; Cloudflare-fronted; byte-identical body to havijmail[.]com; single observation |
| domain | vps-d798fb0f.vps.ovh[.]net | HookBot | 2026-08-08 | HOOKBOT PANEL on :80; resolves to 51.38.113[.]113; single observation |
| domain | orapopo[.]store | ERMAC | 2026-07-02 to 2026-07-17 | Label gone as of 17 August 2026 |
| domain | ces.yeyr[.]lol | ERMAC | 2026-03-25 to 2026-05-11 | Hosted on 137.220.219[.]244 |
| domain | errr.onllee[.]com | ERMAC | 2026-03-31 to 2026-05-15 | Hosted on 137.220.219[.]244 |
| ip | 77.73.135[.]34 | HookBot | 2026-07-09 to 2026-08-19 | Builder on :8088, AEZA (AS210644); no security gate; still live at publication |
| ip | 82.158.90[.]131 | HookBot | 2026-08-18 to 2026-08-19 | API on :8089 and socket on :8000; no panel port on the web surface; cognetcloud (AS401701) |
| ip | 82.158.90[.]133 | HookBot | 2026-08-17 to 2026-08-18 | HOOKBOT PANEL on :50555, API on :8089, socket on :8000; cognetcloud (AS401701) |
| ip | 82.158.90[.]134 | HookBot | 2026-08-18 to 2026-08-19 | Same surface as .133; cognetcloud (AS401701) |
| ip | 118.107.45[.]29 | HookBot | 2026-07-12 to 2026-08-13 | CTG (AS152194); :50555 gone by August, gate active |
| ip | 118.107.45[.]70 | HookBot | 2026-07-12 to 2026-08-13 | Same state as .29 |
| ip | 118.107.45[.]73 | HookBot | 2026-07-10 to 2026-08-13 | Same state as .29 |
| ip | 51.38.113[.]113 | HookBot | 2026-08-08 | Origin for vps-d798fb0f.vps.ovh[.]net; OVH (AS16276); single observation |
| ip | 137.220.219[.]244 | ERMAC | 2026-02-24 to 2026-05-11 | Longest-lived ERMAC host, labeled across 63 days; CTG (AS152194) |
| ip | 185.99.255[.]17 | HookBot | 2026-04-28 to 2026-07-23 | Served HOOKBOT PANEL V5.5 on :80; panel gone since |
| ip | 103.118.199[.]85 | Hook | 2026-08-11 to 2026-08-14 | Reported C2 on :50555; no services indexed by Censys |
| ip | 212.193.23[.]223 | Hook | 2026-07-03 to 2026-07-13 | Reported C2 on :8089 and :50555; no services indexed |
| ip | 93.127.141[.]93 | Hook | 2026-06-04 to 2026-06-11 | Reported C2 on :80; rotated off |
| ip | 62.169.31[.]177 | Hook | 2026-05-12 to 2026-05-19 | Reported C2 on :80; rotated off |
| ip | 118.107.5[.]135 | ERMAC | 2026-03-11 | C2/panel on :8088; since repurposed to Windows services; single observation |
| ip | 45.207.206[.]169 | ERMAC | 2026-06-07 to 2026-06-20 | Open directory on :8888 serving the full ERMAC 3.0 stack; Zenixcloud (AS402506) |
A window closing does not always mean the panel came down. The CTG hosts ending 13 August 2026 switched on the IP-whitelist gate and kept running.
Builder Output (SHA-256)
Recovered from the open directory and hashed, not executed. The two dated builds carry timestamps of 9 June 2026.
| Hash | Artifact |
54536eda036ae8d15baba8e6f7236a5a895e49fe4fe00413cf8e61ffe9ec8353 | ermac_built_20260609_230202.apk |
3991246a9f124baef285f53fa1bf63f325bcf2f16a5ef02dd055349caf5b1dab | ermac_built_20260609_230453.apk |
a8b0ee73d386fe7dbd9be196197421cd87a0672a20b34fc7bbaf2c6016b2f5f6 | Unsigned base APK, input to the repack |
8f2b1ddb2cbe98ddeb92a14434da8ad5076a72a5491a80d87fd037f2d74d73af | Signed build v2 |
6a2cada709868f96a488b1167270c04d771a52adb3cc538d683d6cdf1dc3d7a0 | Signed build v3 |
b75bb1b99e0157cbc5ea7d3e6cfec967c9b2466f1d24403e95be7608869b5ce4 | Signed build v4 |
96411de04d2511f35481d5803aa6bfb2d9fc48c17c0362ef7d9f429837b35b1f | Signed build v5 |
ef56aba60776990fd585b0a853588eb141a71ebd496adbea495c96b08a2746d2 | Signed build v6 |
6c3c7e9d2d2b180f40e8effc5c2de58744d8502c2336c197cb3f2f2e094766ab | Signed build v7 |
10cdbf95c65e1ac64ba341551c7524f0153d4aa6e3df1cc66a629b5f65f6a56c | Signed build v8 |
f6ae6018366457ee74eba8d14c164a35d4d57b93e1f346455a4b771e8ab46e07 | Signed build v9 |
References
- ThreatFabric: Cerberus, a new banking Trojan from the underworld – the August 2019 write-up establishing the family’s origin
- BleepingComputer: Cerberus Android malware source code offered for sale for $100,000 – the July 2020 auction
- Kaspersky: The rise of Cerberus – the September 2020 free release, from Kaspersky’s own analysis of the published archive
- ThreatFabric: BlackRock, the Trojan that wanted to get them all – traces BlackRock to Xerxes and LokiBot, not Cerberus
- ThreatFabric: ERMAC, another Cerberus reborn – the DukeEugene operator link and the Cerberus code basis
- ThreatFabric: Hook, a new Ermac fork with RAT capabilities
- NCC Group: From ERMAC to Hook, technical differences between two Android malware variants
- BleepingComputer: ERMAC source code leak exposes banking trojan infrastructure
- Netcraft: How HookBot malware impersonates brands to steal customer data
- Malpedia: apk.ermac, apk.hook
- Source archives: vx-underground
