cyber.hendryadrian.com
Security News · securityweek.com

Malware targeting car head units linked to BadBox botnet

· Original article ↗

Summary

Kaspersky found malware on DoFun Android car head units, reportedly delivered by exploiting a software-update vulnerability. Researchers suspect MoYu Group involvement and say the malware appears aimed at adding devices to a proxy botnet.

Key points

  • Kaspersky found the malware on DoFun aftermarket Android infotainment systems used in China and other APAC countries.
  • Attackers reportedly exploited a vulnerability in the software-update system to deliver malicious apps; the vendor said it fixed the weakness after notification.
  • The apps can act as droppers, loaders, clickers, and reverse-proxy loaders, with nine supported commands.
  • Researchers observed commands to download a reverse-proxy module, suggesting the malware is intended to recruit devices into a proxy botnet.
  • Kaspersky researchers strongly suspect MoYu Group, which has previously been linked to the BadBox botnet.
  • The report says BadBox has operated since at least 2023 and has expanded beyond budget Android devices to vehicle infotainment systems.

Article Details

Event Type
Discovery of Android malware targeting vehicle head units and linked by researchers to the BadBox botnet.
Impact
Threat actors exploited a vulnerability in DoFun's software-update system to deliver malware to Android-powered aftermarket infotainment systems. The malware can download components and support ad-related activity, but researchers observed commands to download a reverse-proxy module, indicating an apparent goal of adding devices to a proxy botnet. DoFun addressed the weakness after notification.

MITRE ATT&CK

T1195.002 · Compromise Software Supply ChainThreat actors compromised the software-update distribution channel to deliver malware to vehicle head units.

Threat Actors

MoYu GroupKaspersky researchers strongly believe the malware is the work of MoYu Group, which has previously been linked to the development and operation of the BadBox botnet.

Malware

BADBOXResearchers at Kaspersky have come across what appears to be the first malware specifically designed for car head units, and have found links to the notorious BadBox botnet.

Vendors

DoFunThe malware was discovered on an Android-powered aftermarket infotainment system made by Chinese company DoFun, which is widely used in China and other APAC countries.

Products

AndroidThe malware was discovered on an Android-powered aftermarket infotainment system made by Chinese company DoFun, which is widely used in China and other APAC countries.

Countries

ChinaThe malware was discovered on an Android-powered aftermarket infotainment system made by Chinese company DoFun, which is widely used in China and other APAC countries.

Related Articles