First Malware Built Specifically for Car Head Units (DoFun TWCore Update-Chain Abuse) Fuels BadBox Botnet
First Malware Built Specifically for Car Head Units (DoFun (TL-2026-2137) is a high-severity malware campaign, first published 2026-08-25. It is attributed to MoYu Group with high confidence, affects DoFun Android-based aftermarket automotive head units (infotainment, maps to 11 MITRE ATT&CK techniques (T1406, T1407, T1422), and is covered by 9 detection rules and 30 indicators of compromise.
Key facts for TL-2026-2137
- Threat ID
- TL-2026-2137
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-08-25
- Last reviewed
- 2026-08-25
- Attribution
- MoYu Group
- Attribution confidence
- HIGH
- Motivation
- FINANCIAL
- Target sectors
- automotive, consumer, advertising technology
- Target regions
- china, Asia-Pacific
- Detection rules
- 9
- Indicators of compromise
- 30
Malware and tooling in First Malware Built Specifically for Car Head Units (DoFun
Malware and tooling: BadBox, Triada, zhima, ProxyForU
Kaspersky identified the first malware family purpose-built for Android-powered aftermarket car head units, abusing a logic flaw in DoFun's TWCore update-handling app to silently install a three-stage dropper/loader/clicker chain and the "zhima" reverse-proxy module, enrolling infected head units into the BadBox ad-fraud and residential-proxy botnet. Kaspersky attributes the campaign with high confidence to the MoYu Group, previously linked to BadBox operations on TV set-top boxes.
How First Malware Built Specifically for Car Head Units (DoFun works
In June 2026, Kaspersky researchers discovered the first documented malware chain built specifically for Android-based aftermarket automotive head units (infotainment systems) manufactured by the Chinese vendor DoFun. The infection abuses a logic flaw in DoFun's legitimate TWCore system app (package com.tw.core), which handles firmware/software updates: an "installNotExists" boolean flag, when set true by the update-distribution side, permits installation of applications that were never originally present on the device, bypassing the intended update-integrity checks. Malicious APK download instructions are pushed to devices over an MQTT message broker hosted on the cardoor[.]cn domain, and the resulting APKs are written to TWCore's external cache directory before silent installation.
The payload is a three-stage chain. Stage 1, "JarService" (package com.tw.jar1), is a silent, UI-less dropper whose code is XOR-encrypted with linearly shifting single-byte keys; its entry point is the wa method of class com.c.j.qbh. Stage 2 is an unnamed loader that beacons device telemetry (userId, dexVersion, channelId, packageName) to the C2 via HTTP POST and receives a download link and decryption parameters (a single-byte key plus a four-byte floating-point XOR value) for Stage 3. Stage 3 is a clicker/loader that reports device fingerprinting data (display resolution, device model, Wi-Fi SSID, MAC address) to /cpc/api/task every 90 minutes and receives productId-mapped JSON task configurations, additionally polling /cpc/api/xml by GET for unknown or outdated commands. Nine C2 commands are implemented (return, copy, http, web, loadlib, loadlib2, loadlib3, deeplink, traceroute); in observed operation only loadlib2 (download-and-execute arbitrary code via reflection) and http were actively used. A dedicated payload module, "zhima," is a reverse-proxy component that enrolls the device as a residential proxy node, registered and monetized through the ProxyForU service (proxyforu[.]com) and managed via an admin panel at admin.uipoxy[.]com.
Kaspersky attributes the campaign to the MoYu Group with high confidence, based on the internal thread name "mosdk-host-loader" referencing MoYu, and on a related dropper (package com.abc.nexus, service AdmoyuService, hash 3AD4BF5A86D26FFBF09CAE42AF330A98) previously found on Android TV set-top boxes tied to the same actor, plus overlapping campaign infrastructure. Nokia's Deepfield Emergency Response Team independently identified the zhima proxy module on set-top boxes, corroborating the residential-proxy-botnet objective. MoYu Group is linked to BADBOX, the large-scale ad-fraud/residential-proxy operation first documented by HUMAN's Satori Threat Intelligence and Research team in October 2023 as a supply-chain compromise deploying Triada malware on budget off-brand Android devices; BadBox 2.0 was reported by Google's 2025 lawsuit to have infected more than 10 million Android-based devices, and Germany's BSI sinkholed roughly 30,000 BadBox-infected devices in December 2024. This campaign represents the first confirmed expansion of BadBox-linked tradecraft into automotive infotainment hardware. DoFun closed the abused update-handling gap after Kaspersky's responsible disclosure. No CVE has been assigned; the vulnerability is a vendor-specific update-authorization logic flaw rather than a memory-safety or classic software vulnerability.
MITRE ATT&CK techniques used in TL-2026-2137
Defense Evasion
T1406 Obfuscated Files or Information; T1407 Download New Code at Runtime; T1604 Proxy Through Victim; T1655 Masquerading
Discovery
T1422 System Network Configuration Discovery; T1426 System Information Discovery
Command and Control
T1437 Application Layer Protocol; T1544 Ingress Tool Transfer
Initial Access
Collection
Impact
Affected products and versions in First Malware Built Specifically for Car Head Units (DoFun
- DoFun — Android-based aftermarket automotive head units (infotainment systems) running the TWCore (com.tw.core) update/analytics app
Vulnerable versions: TWCore versions predating DoFun's 2026 fix (specific version numbers not published)
Fixed in: TWCore versions released after DoFun's responsible-disclosure remediation in 2026
Remediation for First Malware Built Specifically for Car Head Units (DoFun
Patches
- DoFun fixed the TWCore update-handling logic flaw (installNotExists misuse) following Kaspersky's responsible disclosure in 2026
Immediate actions
- Block network communication to cardoor.cn and the identified BadBox/MoYu Group C2 domains and IPs at DNS and perimeter firewalls
- Inventory DoFun-manufactured aftermarket Android head units in fleet/consumer environments and check TWCore (com.tw.core) update logs for unexpected APK installs
- Remove any installed com.tw.jar1, unidentified Stage-2 loader, or zhima-module packages from affected head units
Workarounds
- Disable automatic/unattended firmware updates on affected DoFun head units until vendor confirmation of the fix is verified
- Monitor for anomalous outbound MQTT traffic and periodic (~90 minute interval) beaconing from infotainment device network segments
Longer-term hardening
- Require OEM/aftermarket infotainment vendors to cryptographically sign and verify update packages end-to-end, rejecting any update flag (e.g. installNotExists) that permits installing apps not present in the original firmware manifest
- Segment in-vehicle infotainment network access from safety-critical vehicle bus systems and restrict outbound infotainment traffic to vendor-approved endpoints
- Extend mobile threat defense / EDR telemetry coverage to embedded Android automotive and IoT device classes, not just phones and TV boxes
Timeline of First Malware Built Specifically for Car Head Units (DoFun
- HUMAN's Satori Threat Intelligence and Research team first documents the original BADBOX operation, a supply-chain-based scheme deploying Triada Android malware on budget off-brand devices.
- Earliest identified malicious DoFun head-unit APK build hosted on the cardoor[.]cn update CDN, indicating the campaign was already active over a year before public disclosure.
- Germany's Federal Office for Information Security (BSI) sinkholes DNS for roughly 30,000 BadBox-infected devices, disrupting C2 communications for the original BadBox botnet.
- Google files suit against the anonymous operators of BadBox 2.0, reporting more than 10 million infected Android-based devices tied to the ad-fraud and residential-proxy scheme.
- A second-generation malicious DoFun head-unit APK build appears on the cardoor[.]cn update CDN, showing continued campaign development.
- Kaspersky researchers first identify the DoFun head-unit-targeting malware chain during routine Android threat monitoring.
- Most recent malicious DoFun head-unit APK build identified on the cardoor[.]cn update CDN, shortly before public disclosure.
- Kaspersky publishes its technical analysis, 'First Android malware targeting automotive head units,' on Securelist, following responsible disclosure that led DoFun to close the abused update-handling gap.
- Mainstream security press, including SecurityWeek, reports on Kaspersky's findings, publicizing the first documented malware family purpose-built for automotive Android head units.
Sources cited for First Malware Built Specifically for Car Head Units (DoFun
- First Android malware targeting automotive head units
- First Malware Built Specifically for Car Head Units Fuels Botnet
- Kaspersky discovers a malware campaign targeting car head units
- Android Car Malware Spreads Through Built-In Updaters for Ad Fraud, Proxy Botnet
- Android car head units infected with proxy botnet malware through built-in software updaters
- Malware Hijacks Android Car Head Units
- Android Car Head-Unit Malware Linked to BadBox Uses Firmware Updates
- New malware targets Android car head units for ad fraud and botnet creation
- Google sues to disrupt BadBox 2.0 botnet infecting 10 million devices
- Germany Disrupts BADBOX Malware on 30,000 Devices Using Sinkhole Action
- Germany Sinkholes Botnet of 30,000 BadBox-Infected Devices
Threats related to First Malware Built Specifically for Car Head Units (DoFun
- JarService/Zhima Multi-Stage Android Malware Targets DoFun Automotive Head Units, Linked to BADBOX Botnet
- Android Car Malware Spreads Through Built-In Updaters for Ad Fraud, Proxy Botnet
- Popa Botnet — Android TV Box Residential-Proxy Malware (Vo1d/Mzmess Plugin) Linked to NetNut / Alarum Technologies
- Octagon / OctagonPanel "Ward" Android RAT Impersonates Bahrain's "BH Alert" Civil Defense App to Steal Credentials, SMS/OTPs, and Banking Data
- Inside the Underground Business of the BTMOB Android RAT Malware-as-a-Service
- Anatsa (TeaBot) Banking Trojan Distributed via Fake "File Horizon Explorer" Document Reader App on Google Play
Detection coverage for TL-2026-2137
As of 2026-08-25, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2137 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.