Android car head units infected with proxy botnet malware through built-in software updaters
Kaspersky found malware delivered via car head unit updaters, attributed to the MoYu Group's BADBOX operation, recruiting devices into a proxy botnet.
Kaspersky discovered malware delivered through the built-in TWCore system updater in Android-based car head units running DoFun infotainment firmware, turning devices into ad-fraud tools and nodes in a proxy botnet. The three-stage infection chain (JarService dropper, loader, and final payload supporting nine commands) installs the zhima reverse-proxy module, which Nokia's Deepfield team independently found on TV set-top boxes. Kaspersky attributes the operation with high confidence to the MoYu Group, linked to the BADBOX supply-chain botnet first identified by HUMAN Security in 2023. DoFun closed the gap after Kaspersky's responsible disclosure.
- First documented malware targeting Android car head units, delivered via the legitimate TWCore system updater
- Attributed with high confidence to the MoYu Group, linked to the BADBOX supply-chain botnet
- Final payload supports nine commands and installs the zhima reverse proxy module, also found on TV set-top boxes
- DoFun closed the flaw after Kaspersky's responsible disclosure; infection chain runs via the cardoor[.]cn message broker
- ATT&CK
- T1195.002 Compromise Software Supply ChainT1105 Ingress Tool TransferT1071.001 Web ProtocolsT1016 System Network Configuration DiscoveryT1082 System Information Discovery
- Threat actors
- MoYu Group
- Malware
- BADBOX
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | cardoor.cn | nstructions from a message broker hosted on a domain called cardoor[.]cn, which tells it which app files to download and install. |
From the original article
3 min read at helpnetsecurity.com
A newly discovered Android malware, distributed through the built-in updaters in affected Android-based car head units, turns infected devices into ad-fraud tools and nodes in a proxy botnet, Kaspersky has found. According to the researchers, it’s the first documented case of malware found on a car head unit with an infection chain specific to that type of device.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.