# Popa Botnet — Android TV Box Residential-Proxy Malware (Vo1d/Mzmess Plugin) Linked to NetNut / Alarum Technologies

> Popa is a proxy-service plugin of the modular Vo1d/Mzmess Android malware that converts unofficial Android TV boxes and pirated streaming apps into a residential-proxy relay. It registers infected devices, maintains long-lived encrypted connections, and opens on-demand tunnels abused for ad fraud, account takeovers, and mass data-scraping. Reporting links the operation to Israeli residential-proxy provider NetNut and its parent Alarum Technologies Ltd (NASDAQ: ALAR).

- **Published:** 2026-06-18T00:00:00Z
- **Last reviewed:** 2026-06-18T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0858
- **ID:** TL-2026-0858
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Vo1d
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Popa is one of four plugins of the modular Android malware family Mzmess, the second-stage payload of the Vo1d botnet (aka LinkDoor). The Mzmess architecture has three components: an 'entry' that downloads the SDK, an 'sdk' that self-updates and downloads plugins (using AES encryption and a shared key, with separate sdkbin, reportcompbin, and pluginbin request channels), and 'plugin' modules that execute business logic. The four observed plugins are Popa (com.app.mz.popan) and Jaguar (com.app.mz.jaguarn) for proxy services, Lxhwdg (com.app.mz.lxhwdgn) for remote access (purpose partly unknown, C2 offline), and Spirit (com.app.mz.spiritn) for ad promotion and traffic inflation.

Popa implements a persistent communications layer that registers a device, maintains long-lived encrypted connections, and opens communication tunnels on demand — effectively enrolling the device into a residential-proxy pool rather than conducting destructive attacks. Infected devices include unofficial Android TV boxes sold under thousands of brand names (e.g. X96 Mini and generic HDMI-stick devices) and pirated/modded streaming apps such as CRICFy, DooFlix, Sprozfy, RTS Tv, Flixoid, CyberFlix, Rapid Streamz, TvMob, and HD/OceanStreams. Researchers also reported proxy SDKs embedded in a large share of LG webOS apps (~42% of ~3,000 apps) and Samsung Tizen apps (~25%), plus mobile VPN, screensaver, and productivity apps. A VPN app named RoboVPN was tied to the Vo1d/Popa ecosystem.

The underlying Vo1d loader chain decrypts a package (ts01) containing install.sh, cv, vo1d, and x.apk, and an ELF variant tracked as s63. The malware masquerades under the package name com.google.android.gms.stable to imitate Google Play Services, and establishes persistence by listening for the BOOT_COMPLETED broadcast so it restarts after reboot. Network communications are protected with RSA (to prevent C2 takeover) and XXTEA-encrypted payloads whose keys are RSA-protected, with a Domain Generation Algorithm (DGA) backing C2 resilience.

The operation runs through an estimated 250-300 controller/Internet addresses directing activity and surfaces 1.5-2.5 million distinct IP addresses daily; researchers monitored 26 of 359+ known relay nodes, each handling roughly 35,000-60,000 simultaneous clients. Reporting (KrebsOnSecurity, Synthient, Qurium) attributes the commercial proxy layer to NetNut, a residential-proxy provider owned by publicly-traded Israeli firm Alarum Technologies Ltd (NASDAQ: ALAR); the control domain ninjatech[.]io was linked to Moishi Kramer, identified as NetNut's VP of Research & Development. NetNut stated the relevant code 'was sold and licensed to third parties including resellers years ago,' while Synthient assessed with high confidence that Popa-infected devices forward traffic from NetNut clients. New Popa control domains were registered following the July 2025 Badbox 2.0 takedown by Google, HUMAN Security, and Trend Micro.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1587 Develop Capabilities
- T1584 Compromise Infrastructure
- T1195 Supply Chain Compromise
- T1204 User Execution
- T1546 Event Triggered Execution
- T1655 Masquerading
- T1406 Obfuscated Files or Information
- T1407 Download New Code at Runtime
- T1573 Encrypted Channel
- T1637 Dynamic Resolution
- T1437 Application Layer Protocol
- T1090 Proxy
- T1544 Ingress Tool Transfer
- T1496 Resource Hijacking
- T1657 Financial Theft

## Sources

- [Popa Botnet Linked to Publicly Traded Israeli Firm](https://krebsonsecurity.com/2026/06/popa-botnet-linked-to-publicly-traded-israeli-firm/)
- [Long Live The Vo1d Botnet: New Variant Hits 1.6 Million TV Globally (XLab/QiAnXin)](https://blog.xlab.qianxin.com/long-live-the-vo1d_botnet/)
- [Vo1d Botnet's Peak Surpasses 1.59M Infected Android TVs, Spanning 226 Countries (The Hacker News)](https://thehackernews.com/2025/03/vo1d-botnets-peak-surpasses-159m.html)
- [Vo1d Botnet Evolves as It Ensnares 1.6 Million Android TV Boxes (SecurityWeek)](https://www.securityweek.com/vo1d-botnet-evolves-as-it-ensnares-1-6-million-android-tv-boxes/)
- [Current botnet profiles - Vo1d (German BSI)](https://www.bsi.bund.de/EN/Themen/Verbraucherinnen-und-Verbraucher/Cyber-Sicherheitslage/Methoden-der-Cyber-Kriminalitaet/Botnetze/Steckbriefe-aktueller-Botnetze/Steckbriefe/Vo1d/Vo1d.html)
- [Vo1d rising: inside the botnet controlling 1.68M+ Android TVs worldwide (Virus Bulletin VB2025)](https://www.virusbulletin.com/conference/vb2025/abstracts/vo1d-rising-inside-botnet-controlling-168-m-android-tvs-worldwide/)
- [Vo1d Botnet Exposed: How Darktrace Detected a Global Android Threat](https://www.darktrace.com/blog/unmasking-vo1d-inside-darktraces-botnet-detection)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0858