Skip to navigation

Threat reportMalwareTL-2026-2100

Android Car Malware Spreads Through Built-In Updaters for Ad Fraud, Proxy Botnet

highACTIVE

Kaspersky researcher Dmitry Kalinin discovered a novel Android malware family in June 2026 targeting DoFun car head unit firmware — the first documented case of malware with an infection chain specifically designed for automotive head units. The malware spreads through the legitimate TWCore system app's OTA update mechanism via MQTT, functioning as a multi-stage downloader enabling ad fraud and proxy botnet creation.

Key facts for MoYu automotive updater botnet

IdentifiersTL-2026-2100
Also known asBadBox Car Campaign, MoYu Car Botnet, DoFun Head Unit Malware
SeverityHIGH
First disclosed
Exploitation statusExploited in the wild
Affected productsDoFun Android-based car head unit firmware
AttributionMoYu Group (high confidence)
Nation-state nexusChina
MalwareBadBox, JarService, Trojan, zhima
MITRE ATT&CK techniquesT1016 System Network Configuration Discovery, T1027 Obfuscated Files or Information, T1036 Masquerading, T1041 Exfiltration Over C2 Channel, T1059.005 Visual Basic, T1071 Application Layer Protocol, T1071.001 Web Protocols, T1082 System Information Discovery, T1090 Proxy, T1090.002 External Proxy, T1105 Ingress Tool Transfer, T1115 Clipboard Data and 10 more in the attack flow
MotivationFINANCIAL
Target sectorsautomotive, transport, consumer-electronics
Target regionsWorldwide
Detection rules9 (1 shown free)
Sources10 cited sources

Detection coverage for MoYu automotive updater botnet

As of 2026-08-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2100 across Splunk SPL, Microsoft KQL and Sigma, covering 32 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Zhima Reverse Proxy C2 Beaconing — 90-Minute Task Polling to .sbs Domains

Detects command-and-control beaconing from the zhima reverse proxy module and JarService Stage 3 clicker on infected DoFun Android head units. The malware beacons to /cpc/api/task every ~90 minutes (configurable via C2), sending device display resolution, model identifier, connected Wi-Fi SSID, MAC address, and config version. C2 infrastructure uses .sbs top-level domains (xmsae.sbs, ishano456.sbs, xshaon123.sbs, etc.) and IPs 107.151.248.132 or 128.14.210.58 for the zhima admin panel. The zhima module converts the head unit into a residential SOCKS proxy node listening on ports 1337/7777/8888/9999.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1071.001, T1090, T1090.002, T1219, T1496
  • Data sources: proxy, dns, network_traffic
  • Severity: critical
  • Confidence: high

Splunk SPL

index=proxy sourcetype=access_combined OR index=dns sourcetype=dns
  (
    dest_domain="*.sbs"
    AND (url="*/cpc/api/task*" OR url="*/cpc/api/report*" OR url="*/cpc/api/xml*")
  )
  OR (dest_ip="107.151.248.132" OR dest_ip="128.14.210.58")
  OR (dest_domain="admin.uipoxy.com" AND url="*/proxy/u/login*")
  | stats count min(_time) as first_seen max(_time) as last_seen
      by src_ip, dest_ip, dest_domain, url, http_method
  | eval threat_id="TL-2026-2100", attack_phase="command_and_control"
  | search url="*/cpc/api/task*" OR dest_ip="107.151.248.132" OR dest_ip="128.14.210.58"
  | eval beacon_interval_avg=case(count>10, round((last_seen-first_seen)/count/60,1), 1=1, null)
  | table first_seen, last_seen, src_ip, dest_ip, dest_domain, url, http_method, count, beacon_interval_avg, threat_id, attack_phase
  | sort first_seen

Microsoft KQL

let c2Ips = dynamic(["107.151.248.132", "128.14.210.58", "144.217.243.201"]);
let c2Domains = dynamic(["xmsae.sbs", "ishano456.sbs", "xshaon123.sbs", "kshahnd.sbs", "mdsjhd.sbs", "nmnsny.sbs", "admin.uipoxy.com"]);
DeviceNetworkEvents
| where Timestamp > ago(30d)
| where RemoteIP in (c2Ips)
    or RemoteUrl has_any (c2Domains)
    or RemoteUrl contains "/cpc/api/"
| project Timestamp, DeviceName, RemoteIP, RemotePort, RemoteUrl, Protocol, ThreatId = "TL-2026-2100"
| extend c2Stage = case(
    RemoteUrl contains "/cpc/api/task", "stage3-beacon",
    RemoteUrl contains "/cpc/api/report", "stage3-report",
    RemoteUrl contains "/proxy/u/login", "zhima-admin",
    RemoteIP == "107.151.248.132" or RemoteIP == "128.14.210.58", "zhima-c2",
    "payload-delivery"
  )
| sort by Timestamp asc

Sigma

title: Zhima Reverse Proxy C2 Beaconing to .sbs Domains and Known C2 Infrastructure
id: 9d4e6f8b-1a3c-4b5d-82e7-f0a9c8d7e6b5
status: experimental
description: Detects network beaconing to JarService/zhima C2 infrastructure — periodic HTTP requests to /cpc/api/task and /cpc/api/report endpoints on *.sbs domains, connections to known C2 IPs, or access to the zhima admin panel at admin.uipoxy.com/proxy/u/login. The malware beacons every ~90 minutes with device fingerprint information.
references:
  - https://securelist.com/android-head-unit-malware/121106/
  - https://github.com/deepfield/public-research
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-21
tags:
  - attack.command-and-control
  - attack.t1071.001
  - attack.t1090
  - attack.t1090.002
  - attack.t1219
  - attack.t1496
  - attack.tool.zhima
logsource:
  category: network
  product: proxy
  definition: 'Requires proxy or DNS logs capturing outbound HTTP/HTTPS traffic from Android head unit network segments'
detection:
  selection_c2_api:
    destination_url|contains:
      - '/cpc/api/task'
      - '/cpc/api/report'
      - '/cpc/api/xml'
  selection_c2_domain:
    destination_domain|endswith:
      - '.sbs'
  selection_c2_ip:
    destination_ip:
      - '107.151.248.132'
      - '128.14.210.58'
  selection_zhima_admin:
    destination_url|contains:
      - '/proxy/u/login'
    destination_domain: 'admin.uipoxy.com'
  condition: selection_c2_api or selection_c2_ip or (selection_c2_domain and selection_c2_api) or selection_zhima_admin
falsepositives:
  - Benign traffic to .sbs TLD domains (uncommon but possible for legitimate services)
  - Generic network scanning or web crawling
level: critical

Known false positives:

  • Non-malicious traffic to .sbs TLD domains (rare but possible for legitimate services)
  • General web browsing or network scanning activity from head unit browsers
  • Legitimate admin panel access to unrelated .sbs domains

Tuning notes: Prioritize the /cpc/api/task endpoint detection as it is unique to this malware family. Correlate periodic connections (every ~90 minutes) to reduce false positives. Monitor for both the API path structure AND the .sbs domain combination for higher fidelity. Consider adding behavioral detection for unusually long-lived TCP connections on ports 1337/7777/8888/9999 which indicate zhima proxy activation.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • DoFun Head Unit Unauthorized APK Installation via TWCore OTA Abuse (KQL) · unlock with TL Creds
  • JarService Java Reflection and DEX Class Loading on Android Head Units (KQL) · unlock with TL Creds
  • Zhima Reverse Proxy C2 Beaconing and Residential Proxy Node Activation (KQL) · unlock with TL Creds
  • DoFun Head Unit TWCore MQTT OTA Abuse Leading to JarService Delivery (Sigma) · unlock with TL Creds
  • JarService Trojan XOR-Decrypted DEX Loading and Java Reflection Execution (Sigma) · unlock with TL Creds
  • Zhima Reverse Proxy and JarService C2 Beaconing on Android Head Units (Sigma) · unlock with TL Creds
  • DoFun Head Unit TWCore MQTT OTA Abuse — JarService Dropper Delivery · unlock with TL Creds
  • JarService XOR-Decrypted Java Reflection Payload Execution · unlock with TL Creds

Indicators of compromise for MoYu automotive updater botnet

As of 2026-08-23, Threadlinqs Intelligence tracks 32 indicators of compromise for TL-2026-2100.

Sample indicators (3 of 32)

  • IP address: 144.217.243[.]201
  • Domain: cardoor[.]cn
  • File hash: ba27951b4ee1c341f4415d033369ecd3

Defanged, TLP:CLEAR. Full set of 32 indicators: unlock with TL Creds.

32 indicators of compromise · unlock with TL Creds. Compare plans

How MoYu automotive updater botnet works

Attributed with high confidence to MoYu Group, the threat actor behind the BADBOX 2.0 ecosystem.

In June 2026, Kaspersky researcher Dmitry Kalinin identified a sophisticated multi-stage Android malware campaign targeting automotive head units manufactured by DoFun — a Chinese company that develops firmware, apps, and cloud services for Android-based car infotainment systems serving over 30 million vehicle owners worldwide. This represents the first documented case of malware specifically designed for and distributed through car head unit infection chains.

The infection vector exploits TWCore (com.tw.core), a legitimate system application pre-installed on DoFun head units responsible for collecting analytics and performing over-the-air (OTA) software updates. TWCore communicates with an MQTT message broker hosted at cardoor.cn to receive installation instructions. A Boolean flag called 'installNotExists' in the MQTT message allows TWCore to install applications that were not originally present on the device — a design feature that attackers weaponized to deliver the JarService Trojan dropper.

The malware operates across four stages. Stage 1 (JarService) is a small dropper APK with no user interface that contains XOR-encrypted payload blocks, each encrypted with a single-byte key that shifts linearly between blocks. The decrypted data reveals payload version information, an entry point class (wa method of com.c.j.qbh), and the next-stage loading code. Stage 2 decrypts runtime strings and uses Java reflection to invoke and execute Stage 3. It sends device information to the C2 server via an HTTP POST to obtain the next-stage payload URL (e.g., 144.217.243.201/vr34der34/dex3.68.png). Seven distinct payload variants were retrieved by Kaspersky through version number probing, with the earliest being version 3.57 using a different decoding algorithm.

Stage 3 operates as a clicker and reverse proxy loader, beaconing to the C2 endpoint /cpc/api/task every 90 minutes by default. The beacon payload includes device display resolution, model identifier, connected Wi-Fi SSID, MAC address, and the Trojan's configuration version. If the C2 determines the configuration is outdated, it returns updated C2 addresses (on .sbs TLD domains), new API paths, and interval settings — the most recent config version observed was 3.82. If new command identifiers (productId values) are present, the malware fetches their definitions from /cpc/api/xml.

The malware supports nine distinct commands stored as serialized JSON in SharedPreferences: return (retrieve stored values), copy (set clipboard contents), http (arbitrary HTTP POST/GET requests), web (open WebView and execute arbitrary JavaScript), loadlib2 (download and execute arbitrary code from a URL), deeplink (open browser URLs), and traceroute (ICMP ping checks). Commands loadlib and loadlib3 are not yet fully implemented. In observed attacks, only loadlib2 and http were actively used.

Through the loadlib2 and http commands, attackers deliver the zhima reverse proxy module — downloaded from URLs like 144.217.243.201/vr34der34/sh65.io with eight documented variants (earliest version 57). Zhima converts infected head units into residential proxy nodes by instantiating the module with C2 IPs (107.151.248.132, 128.14.210.58), proxy ports (1337/9999, 7777, 8888), and a 15-second timeout. The domain admin.uipoxy.com resolves to 128.14.210.58 and hosts the zhima administrative panel at /proxy/u/login, requiring an invite code for registration.

Kaspersky identified links between MoYu Group and two residential proxy services: PXYEDGE (pxyedge.com) and ProxyForU (proxyforu.com). Both offer residential proxy services that route paying clients' traffic through infected devices, and share identical API patterns — sign-in on admin.* subdomains at /proxy/u/login and signup at /proxy/register?channelKey=<invitation code>. Researchers assess these services are directly connected to MoYu Group.

The operation is attributed with high confidence to MoYu Group, previously exposed by HUMAN Security's Satori team as a key operator within the BADBOX 2.0 malware ecosystem — a massive botnet that infected over 1 million off-brand Android Open Source Project (AOSP) devices. In July 2025, Google filed a federal lawsuit in New York against 25 unnamed Chinese entities for operating BADBOX 2.0 under the Computer Fraud and Abuse Act and RICO Act. Despite multiple disruption efforts including a December 2024 sinkhole by Germany's BSI affecting ~30,000 devices and a March 2025 sinkhole of BADBOX 2.0 domains disrupting 500,000+ devices, individual actors continue their malicious activities.

Nokia Deepfield's Emergency Response Team independently confirmed the same zhima reverse proxy module on TV set-top boxes, corroborating the campaign's infrastructure expansion from Android TV devices into automotive platforms. Following responsible disclosure, DoFun reported fixing the security issues in their firmware update mechanism. However, Kaspersky warns that individual actors associated with the campaign continue infecting devices worldwide.

MITRE ATT&CK techniques by tactic:

Discovery

T1016 System Network Configuration Discovery; T1082 System Information Discovery; T1518 Software Discovery

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1620 Reflective Code Loading

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1059.005 Visual Basic

Command and Control

T1071 Application Layer Protocol; T1071.001 Web Protocols; T1090 Proxy; T1090.002 External Proxy; T1105 Ingress Tool Transfer; T1219 Remote Access Tools

Collection

T1115 Clipboard Data

Initial Access

T1195.002 Compromise Software Supply Chain

Impact

T1496 Resource Hijacking

Persistence

T1554 Compromise Host Software Binary

Resource Development

T1583 Acquire Infrastructure; T1584 Compromise Infrastructure; T1587.001 Malware

Remediation for MoYu automotive updater botnet

Patches

  • Apply the latest official DoFun firmware update (vendor has reported fixing the security issues)

Immediate actions

  • Check head units for unauthorized apps (JarService, com.tw.jar1) using package manager
  • Block C2 domains at network perimeter: cardoor.cn, all *.sbs domains, admin.uipoxy.com, pxyedge.com, proxyforu.com
  • Block C2 IPs: 144.217.243.201, 107.151.248.132, 128.14.210.58
  • Monitor for anomalous outbound HTTP POSTs to /cpc/api/task or /cpc/api/report endpoints
  • Inspect TWCore external cache directory for files under push/apk/ path

Workarounds

  • Disable unnecessary internet connectivity on head units where feasible
  • Audit and remove the TWCore update channel if not required
  • Restrict outbound MQTT traffic to only known update servers

Longer-term hardening

  • Implement firmware integrity validation and code signing for all OTA updates
  • Restrict MQTT-based update mechanisms to allow only vendor-signed content
  • Deploy network segmentation for automotive head units away from critical vehicle systems
  • Establish behavioral detection rules for Java reflection-based code loading on Android devices
  • Implement supply-chain security reviews for third-party firmware components

Affected and fixed versions

  • DoFun — Android-based car head unit firmware
    Vulnerable versions: All firmware versions before security fix (June 2026)
    Fixed in: Post-June 2026 firmware update

Timeline of MoYu automotive updater botnet

Last updated · revalidated 1× · latest source

  • Original BADBOX scheme publicly disclosed and disrupted by HUMAN Security's Satori team
  • Earliest known locked-ioc-30 dropper variant uploaded to DoFun update infrastructure via locked-ioc-27
  • Germany's Federal Office for Information Security (BSI) sinkholes ~30,000 BadBox-infected devices
  • HUMAN Security officially discloses BADBOX 2.0 operation; 500,000+ devices sinkholed via Shadowserver Foundation
  • HUMAN Security's Satori Threat Intelligence team, working with Google, Trend Micro, and Shadowserver, publicly discloses and partially disrupts BADBOX 2.0 infrastructure and formally exposes MoYu Group as an operator.
  • Additional locked-ioc-30 variant observed on DoFun update infrastructure
  • Google files federal lawsuit in New York against 25 unnamed Chinese entities for operating BADBOX 2.0 under CFAA and RICO
  • Latest locked-ioc-30 variant observed; Kaspersky researcher Dmitry Kalinin discovers the car head unit malware campaign
  • Kaspersky notifies DoFun about the distribution scheme; vendor reports fixing the security issues
  • Nokia Deepfield Emergency Response Team independently confirms locked-ioc-32 reverse proxy module on TV set-top boxes, corroborating infrastructure overlap
  • Public disclosure by Kaspersky and The Hacker News; first documented malware campaign targeting car head units revealed

Update history

Sources cited for MoYu automotive updater botnet

Previous and next in malware

Drafted by the Threadlinqs research pipeline from 10 sources; published ; last updated .

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats