Android Car Head Units Targeted Through DoFun Update App in Proxy Botnet Campaign
Summary
Kaspersky says a supply-chain attack used DoFun’s TWCore app to deliver JarService malware to Android car head units. The MoYu-linked operation can enlist devices as proxy nodes and support ad fraud; DoFun says it fixed the issue.
Key points
- Kaspersky found a rogue APK delivered through DoFun’s TWCore update app, which receives instructions via an MQTT server at cardoor[.]cn.
- JarService runs a second-stage loader, communicates with a command-and-control server, downloads another payload, and reports device details.
- The malware supports commands including downloading and executing additional code, opening web content, and making HTTP requests.
- Kaspersky says operators used the zhima reverse-proxy module and made web requests for click fraud.
- Kaspersky attributed the operation to MoYu, which it had previously associated with the BadBox botnet.
- Kaspersky said the malware does not interfere with driving or critical vehicle controls; DoFun told researchers it had resolved the issue.
Article Details
- Event Type
- Supply-chain malware campaign targeting Android-based car head units
- Impact
- JarService delivered additional payloads, collected device information, and enabled infected head units to become residential proxy nodes or support advertising fraud. Kaspersky said the malware did not interfere with driving or critical vehicle-control systems. DoFun reportedly resolved the issue.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | cardoor[.]cn | MQTT instruction server used by the DoFun system app in the malware infection chain. |
Threat Actors
Malware
Vendors
DoFunA supply-chain attack against Android-based car head units is spreading malware through a legitimate DoFun update app, turning compromised devices into proxy botnet nodes and tools for ad fraud.Shenzhen Driving Control Technology Co., Ltd.MoYu’s operation targets systems from DoFun, a Chinese automotive software and hardware provider owned by Shenzhen Driving Control Technology Co., Ltd.