Skip to navigation

Threat reportMalwareTL-2026-2137

First Malware Built Specifically for Car Head Units (DoFun TWCore Update-Chain Abuse) Fuels BadBox Botnet

highACTIVE

Kaspersky identified the first malware family purpose-built for Android-powered aftermarket car head units, abusing a logic flaw in DoFun's TWCore update-handling app to silently install a three-stage dropper/loader/clicker chain and the "zhima" reverse-proxy module, enrolling infected head units into the BadBox ad-fraud and residential-proxy botnet.

Key facts for TWCore car malware

IdentifiersTL-2026-2137
SeverityHIGH
Exploitation statusExploited in the wild
Affected productsDoFun Android-based aftermarket automotive head units (infotainment systems) running the TWCore (com.tw.core) update/analytics app
AttributionMoYu Group (high confidence)
MalwareBadBox, Triada, zhima
ToolsProxyForU
MITRE ATT&CK techniquesT1406 Obfuscated Files or Information, T1407 Download New Code at Runtime, T1422 System Network Configuration Discovery, T1426 System Information Discovery, T1437 Application Layer Protocol, T1474 Supply Chain Compromise, T1533 Data from Local System, T1544 Ingress Tool Transfer, T1604 Proxy Through Victim, T1643 Generate Traffic from Victim, T1655 Masquerading
MotivationFINANCIAL
Target sectorsautomotive, consumer, advertising technology
Target regionschina, Asia-Pacific
Detection rules9 (1 shown free)
Sources11 cited sources

Detection coverage for TWCore car malware

As of 2026-08-25, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2137 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: JarService/Stage-2 XOR-Obfuscated Dropper Telemetry Beacon to BadBox C2

Detects the Stage-2 loader's HTTP POST beacon that exfiltrates device fingerprinting telemetry (userId, dexVersion, channelId, packageName — feeding System Information/Network Configuration Discovery) to known BadBox/MoYu Group C2 domains (xmsae.sbs, ishano456.sbs, kookjar.com) or campaign IPs, immediately after the XOR-encrypted com.tw.jar1 JarService dropper (entry point com.c.j.qbh.wa) executes. This beacon is how Stage 2 receives the Stage-3 download link and single-byte/four-byte-float decryption parameters, representing Obfuscated Files or Information, Download New Code at Runtime, and Data from Local System.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1406, T1407, T1533, T1426, T1422
  • Data sources: network_proxy_logs, mobile_threat_defense_events, mdm_app_inventory, endpoint_process_telemetry
  • Severity: critical
  • Confidence: high

Splunk SPL

index=network (sourcetype=proxy OR sourcetype=stream:http)
| eval c2_domain=coalesce(dest_domain, url_domain)
| where match(c2_domain, "(?i)^(xmsae\.sbs|ishano456\.sbs|kookjar\.com)$") OR dest_ip IN ("144.217.243.201","107.151.248.132","128.14.210.58")
| where http_method="POST"
| eval telemetry_hit=if(match(form_data, "(?i)(userId|dexVersion|channelId|packageName)") OR match(http_content_type, "(?i)application/json"), 1, 0)
`comment("Stage-2 loader beacons device telemetry to BadBox/MoYu C2 and receives Stage-3 dex download link + XOR key material — T1406 Obfuscated Files, T1407 Download New Code at Runtime, T1533 Data from Local System")`
| stats count min(_time) as first_seen max(_time) as last_seen values(c2_domain) as domains values(dest_ip) as ips sum(telemetry_hit) as telemetry_beacon_count by src_ip
| where count > 0
| sort -count

Microsoft KQL

let badboxC2 = dynamic(["xmsae.sbs", "ishano456.sbs", "kookjar.com"]);
let badboxIPs = dynamic(["144.217.243.201", "107.151.248.132", "128.14.210.58"]);
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has_any (badboxC2) or RemoteIP in (badboxIPs)
| where InitiatingProcessFileName has_any ("jar1", "com.tw.jar1") or isempty(InitiatingProcessFileName)
| extend TelemetryLikely = RemoteUrl has_any ("userId", "dexVersion", "channelId", "packageName")
| project Timestamp, DeviceId, DeviceName, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessFileName, TelemetryLikely
| summarize FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Domains = make_set(RemoteUrl), BeaconCount = count() by DeviceId, DeviceName
| where BeaconCount > 0
| order by BeaconCount desc

Sigma

title: BadBox Stage-2 Loader Telemetry Beacon to MoYu Group C2
id: 9b6f4a2e-1d3c-4f8a-b5e6-2c7a9d4e6f11
status: experimental
description: Detects HTTP POST beacons carrying Android device fingerprinting telemetry (userId, dexVersion, channelId, packageName) from the BadBox Stage-2 loader to known MoYu Group C2 domains/IPs, used to negotiate Stage-3 payload download and decryption parameters.
references:
    - https://securelist.com/android-head-unit-malware/121106/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-25
tags:
    - attack.defense-evasion
    - attack.t1406
    - attack.t1407
    - attack.collection
    - attack.t1533
    - attack.discovery
    - attack.t1426
    - attack.t1422
    - attack.malware.badbox
    - attack.tool.jarservice
logsource:
    category: proxy
    product: network
detection:
    sel_domain:
        c-uri|contains:
            - 'xmsae.sbs'
            - 'ishano456.sbs'
            - 'kookjar.com'
    sel_ip:
        dst_ip:
            - '144.217.243.201'
            - '107.151.248.132'
            - '128.14.210.58'
    sel_method:
        cs-method: 'POST'
    condition: (sel_domain or sel_ip) and sel_method
falsepositives:
    - None expected; these domains/IPs are dedicated BadBox/MoYu Group campaign infrastructure with no known legitimate use
level: high

Known false positives:

  • Extremely unlikely given the C2 domains have no benign registrant use; if a proxy rewrites/anonymizes destination IPs, confirm via SNI/Host header before triage

Tuning notes: Where available, join against MDM app-inventory logs for the presence of package com.tw.jar1 (hashes ba27951b4ee1c341f4415d033369ecd3, d63bacd6d6709dd68a10ef9d374c7835, 6c2e34b30da42085240ede53ab6107d4) to raise confidence to critical; without process-level attribution, treat this purely as high-confidence network C2 indication.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • DoFun TWCore Unauthorized APK Distribution via [indicator] MQTT/Update Channel · unlock with TL Creds
  • JarService/Stage-2 XOR-Obfuscated Dropper Telemetry Beacon to BadBox C2 · unlock with TL Creds
  • BadBox Stage-3 Clicker 90-Minute C2 Polling and zhima Residential Proxy Enrollment · unlock with TL Creds
  • DoFun TWCore Unauthorized APK Distribution via [indicator] MQTT/Update Channel · unlock with TL Creds
  • JarService/Stage-2 XOR-Obfuscated Dropper Telemetry Beacon to BadBox C2 · unlock with TL Creds
  • BadBox Stage-3 Clicker 90-Minute C2 Polling and zhima Residential Proxy Enrollment · unlock with TL Creds
  • DoFun TWCore Unauthorized APK Distribution via [indicator] MQTT/Update Channel · unlock with TL Creds
  • BadBox Stage-3 Clicker 90-Minute C2 Polling and zhima Residential Proxy Enrollment · unlock with TL Creds

Indicators of compromise for TWCore car malware

As of 2026-08-25, Threadlinqs Intelligence tracks 30 indicators of compromise for TL-2026-2137.

Sample indicators (3 of 30)

  • IP address: 144.217.243[.]201
  • Domain: cardoor[.]cn
  • File hash: ba27951b4ee1c341f4415d033369ecd3

Defanged, TLP:CLEAR. Full set of 30 indicators: unlock with TL Creds.

30 indicators of compromise · unlock with TL Creds. Compare plans

How TWCore car malware works

Kaspersky attributes the campaign with high confidence to the MoYu Group, previously linked to BadBox operations on TV set-top boxes.

In June 2026, Kaspersky researchers discovered the first documented malware chain built specifically for Android-based aftermarket automotive head units (infotainment systems) manufactured by the Chinese vendor DoFun. The infection abuses a logic flaw in DoFun's legitimate TWCore system app (package com.tw.core), which handles firmware/software updates: an "installNotExists" boolean flag, when set true by the update-distribution side, permits installation of applications that were never originally present on the device, bypassing the intended update-integrity checks. Malicious APK download instructions are pushed to devices over an MQTT message broker hosted on the cardoor[.]cn domain, and the resulting APKs are written to TWCore's external cache directory before silent installation.

The payload is a three-stage chain. Stage 1, "JarService" (package com.tw.jar1), is a silent, UI-less dropper whose code is XOR-encrypted with linearly shifting single-byte keys; its entry point is the wa method of class com.c.j.qbh. Stage 2 is an unnamed loader that beacons device telemetry (userId, dexVersion, channelId, packageName) to the C2 via HTTP POST and receives a download link and decryption parameters (a single-byte key plus a four-byte floating-point XOR value) for Stage 3. Stage 3 is a clicker/loader that reports device fingerprinting data (display resolution, device model, Wi-Fi SSID, MAC address) to /cpc/api/task every 90 minutes and receives productId-mapped JSON task configurations, additionally polling /cpc/api/xml by GET for unknown or outdated commands. Nine C2 commands are implemented (return, copy, http, web, loadlib, loadlib2, loadlib3, deeplink, traceroute); in observed operation only loadlib2 (download-and-execute arbitrary code via reflection) and http were actively used. A dedicated payload module, "zhima," is a reverse-proxy component that enrolls the device as a residential proxy node, registered and monetized through the ProxyForU service (proxyforu[.]com) and managed via an admin panel at admin.uipoxy[.]com.

Kaspersky attributes the campaign to the MoYu Group with high confidence, based on the internal thread name "mosdk-host-loader" referencing MoYu, and on a related dropper (package com.abc.nexus, service AdmoyuService, hash 3AD4BF5A86D26FFBF09CAE42AF330A98) previously found on Android TV set-top boxes tied to the same actor, plus overlapping campaign infrastructure. Nokia's Deepfield Emergency Response Team independently identified the zhima proxy module on set-top boxes, corroborating the residential-proxy-botnet objective. MoYu Group is linked to BADBOX, the large-scale ad-fraud/residential-proxy operation first documented by HUMAN's Satori Threat Intelligence and Research team in October 2023 as a supply-chain compromise deploying Triada malware on budget off-brand Android devices; BadBox 2.0 was reported by Google's 2025 lawsuit to have infected more than 10 million Android-based devices, and Germany's BSI sinkholed roughly 30,000 BadBox-infected devices in December 2024. This campaign represents the first confirmed expansion of BadBox-linked tradecraft into automotive infotainment hardware. DoFun closed the abused update-handling gap after Kaspersky's responsible disclosure. No CVE has been assigned; the vulnerability is a vendor-specific update-authorization logic flaw rather than a memory-safety or classic software vulnerability.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1406 Obfuscated Files or Information; T1407 Download New Code at Runtime; T1604 Proxy Through Victim; T1655 Masquerading

Discovery

T1422 System Network Configuration Discovery; T1426 System Information Discovery

Command and Control

T1437 Application Layer Protocol; T1544 Ingress Tool Transfer

Initial Access

T1474 Supply Chain Compromise

Collection

T1533 Data from Local System

Impact

T1643 Generate Traffic from Victim

Remediation for TWCore car malware

Patches

  • DoFun fixed the TWCore update-handling logic flaw (installNotExists misuse) following Kaspersky's responsible disclosure in 2026

Immediate actions

  • Block network communication to cardoor.cn and the identified BadBox/MoYu Group C2 domains and IPs at DNS and perimeter firewalls
  • Inventory DoFun-manufactured aftermarket Android head units in fleet/consumer environments and check TWCore (com.tw.core) update logs for unexpected APK installs
  • Remove any installed com.tw.jar1, unidentified Stage-2 loader, or zhima-module packages from affected head units

Workarounds

  • Disable automatic/unattended firmware updates on affected DoFun head units until vendor confirmation of the fix is verified
  • Monitor for anomalous outbound MQTT traffic and periodic (~90 minute interval) beaconing from infotainment device network segments

Longer-term hardening

  • Require OEM/aftermarket infotainment vendors to cryptographically sign and verify update packages end-to-end, rejecting any update flag (e.g. installNotExists) that permits installing apps not present in the original firmware manifest
  • Segment in-vehicle infotainment network access from safety-critical vehicle bus systems and restrict outbound infotainment traffic to vendor-approved endpoints
  • Extend mobile threat defense / EDR telemetry coverage to embedded Android automotive and IoT device classes, not just phones and TV boxes

Affected and fixed versions

  • DoFun — Android-based aftermarket automotive head units (infotainment systems) running the TWCore (com.tw.core) update/analytics app
    Vulnerable versions: TWCore versions predating DoFun's 2026 fix (specific version numbers not published)
    Fixed in: TWCore versions released after DoFun's responsible-disclosure remediation in 2026

Timeline of TWCore car malware

  • HUMAN's Satori Threat Intelligence and Research team first documents the original locked-ioc-29 operation, a supply-chain-based scheme deploying Triada Android malware on budget off-brand devices.
  • Earliest identified malicious DoFun head-unit APK build hosted on the locked-ioc-26 update CDN, indicating the campaign was already active over a year before public disclosure.
  • Germany's Federal Office for Information Security (BSI) sinkholes DNS for roughly 30,000 BadBox-infected devices, disrupting C2 communications for the original locked-ioc-29 botnet.
  • Google files suit against the anonymous operators of locked-ioc-29 2.0, reporting more than 10 million infected Android-based devices tied to the ad-fraud and residential-proxy scheme.
  • A second-generation malicious DoFun head-unit APK build appears on the locked-ioc-26 update CDN, showing continued campaign development.
  • Kaspersky researchers first identify the DoFun head-unit-targeting malware chain during routine Android threat monitoring.
  • Most recent malicious DoFun head-unit APK build identified on the locked-ioc-26 update CDN, shortly before public disclosure.
  • Kaspersky publishes its technical analysis, 'First Android malware targeting automotive head units,' on Securelist, following responsible disclosure that led DoFun to close the abused update-handling gap.
  • Mainstream security press, including SecurityWeek, reports on Kaspersky's findings, publicizing the first documented malware family purpose-built for automotive Android head units.

Sources cited for TWCore car malware

Previous and next in malware

Drafted by the Threadlinqs research pipeline from 11 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats