MoYu Group (BADBOX-linked) malware spreads via DoFun Android head unit updater, building ad-fraud and proxy botnet

Linha do tempo

1. securelist.com ↗ · pub. 21/08/2026 05:00 · coletado 19/10 17:57 primeiro registro

   MoYu Group (BADBOX-linked) malware spreads via DoFun Android head unit updater, building ad-fraud and proxy botnet

   ler a análise desta fonte ocultar

   Kaspersky found the first documented Android malware targeting automotive head units, discovered in June 2026. It is a multi-stage downloader whose ultimate purpose is ad fraud and a residential proxy botnet. It spread through the built-in updater (TWCore, package com.tw.core) of DoFun head unit firmware, which installs APKs pushed over an MQTT broker. Kaspersky attributes the activity with high confidence to MoYu Group, an actor linked to the BADBOX botnet, based on naming patterns and infrastructure overlap also reported by the Nokia Deepfield Emergency Response Team. The vendor was notified and reported fixing the security issues.

   Technical Details

   • Delivery: the MQTT broker on a cardoor[.]cn subdomain sends messages describing APKs to install. The installNotExists flag lets TWCore install apps not already present. APKs land in <TWCore external cache dir>/push/apk/, and in every observed case the malware was installed by com.tw.core.
   • Stage 1, JarService: a UI-less dropper that decrypts blocks with a single-byte XOR key that shifts linearly between blocks. The decrypted data holds the payload version, entry point (com.c.j.qbh.wa) and loader code.
   • Stage 2: a loader with encrypted class names, executed via reflection. It POSTs implant information to the C2 and receives a dexUrl link for stage 3. A thread named mosdk-host-loader links it to the MoYu mosdk naming.
   • Stage 3: a clicker and reverse proxy loader (entry point com.ast.sdk.BillingMain.init). It beacons to /cpc/api/task every 90 minutes with device data (resolution, model, Wi-Fi SSID, MAC address) and the config version. It receives updated configs and productId commands, fetching command content from /cpc/api/xml. Nine commands exist, covering ad display, clicking and loading additional code. In the wild only loadlib2 and http were used, and loadlib2 delivers the zhima reverse proxy module. Kaspersky retrieved seven stage 3 variants (earliest 3.57) and eight zhima variants (earliest 57) by enumerating version numbers.
   • Infrastructure: admin.uipoxy[.]com resolves to 128.14.210[.]58 and hosts the zhima admin panel, which allows invite-code registration. Related sites include residential proxy vendors PXYEDGE and ProxyForU, which share the /proxy/u/login and /proxy/register?channelKey= URL patterns. A related app, com.abc.nexus, was found on TV set-top boxes, with an AdmoyuService service.
   • Detections: Kaspersky detects the threats as HEUR:Trojan-Dropper.AndroidOS.Agent.vu, HEUR:Trojan-Downloader.AndroidOS.Agent.ov, HEUR:Trojan-Proxy.AndroidOS.Zhima.* and HEUR:Trojan.AndroidOS.Vo1d.*.

   Remediation

   • Block the listed domains, IPs and URLs, and hunt for APKs in the TWCore push/apk/ cache path.
   • Apply vendor firmware fixes for DoFun head units and verify the update channel (MQTT and CDN) is authenticated.
   • Treat head units as endpoints that need malware protection.