Android Car Head Unit Malware Builds Proxy Botnet

Executive Summary

Kaspersky researchers have uncovered a new Android malware campaign that targets automotive head units, turning vehicles into nodes of a proxy botnet and ad-fraud operation. This is the first documented case of malware with an infection chain specific to car head units, delivered through the legitimate software updater of DoFun head units. The malware, attributed with high confidence to the MoYu Group (linked to the BADBOX botnet), operates in three stages, ultimately using infected devices as proxies and for click fraud.

Defenders should be aware that Android-based head units, often overlooked in security strategies, can be compromised through supply-chain attacks on firmware update mechanisms. The malware does not disguise itself as a legitimate app; it has no UI, indicating it is installed without user knowledge. Kaspersky detected the malware under several names, including HEUR:Trojan-Dropper.AndroidOS.Agent.vu and HEUR:Trojan-Proxy.AndroidOS.Zhima.*.

Technical Analysis

The infection chain begins with the TWCore app, a legitimate system application on DoFun head units responsible for analytics and software updates. TWCore uses an MQTT message broker at cardoor[.]cn to receive instructions on which APK files to download and install. A critical flaw: the installNotExists flag in the MQTT message can be set to true, allowing TWCore to install apps not originally present on the device. The APK is downloaded to <TWCore external cache dir>/push/apk/ and installed without user interaction.

Kaspersky's telemetry showed previously unknown malware at these paths, installed by the package com.tw.core, confirming TWCore as the distribution vector. The malware itself is a multi-stage dropper:

Stage 1: JarService dropper – This small app has no UI and decrypts data stored as XOR-encrypted blocks within its code. The decrypted data contains serialized information about the payload version and entry point, along with the malware's own code for further loading. In the analyzed version, the entry point is the wa method of the com.c.j.qbh class.

Stage 2: Loader – This stage contains encrypted strings that are used as class names to execute the stage 3 payload via reflection. The loader sends a POST request to the attackers' C2 server with implant information, including userId, dexVersion, channelId, and packageName (e.g., com.tw.jar1).

Stage 3: Clicker / reverse proxy loader – The final stage is a clicker and a reverse proxy module, likely named zhima. This module enables ad fraud by simulating clicks and also turns the device into a proxy, allowing the attacker to route traffic through the infected head unit.

Kaspersky notified DoFun about the distribution scheme, and the vendor subsequently reported fixing the security issues. However, the researchers note that head units often have SIM slots and internet connectivity, making them viable targets for botnet recruitment.

Indicators of Compromise

The primary IOC is the MQTT broker domain cardoor[.]cn, used by TWCore to receive malicious APK instructions. Kaspersky also lists detection names for the malware, but specific file hashes and C2 IPs are not publicly disclosed in the article. The malware's package names include com.tw.jar1 (JarService) and likely others for the loader and clicker stages.

Tactics, Techniques & Procedures

The attack leverages a supply-chain compromise (T1195) by abusing the legitimate TWCore update mechanism. Execution is achieved through a multi-stage dropper and loader using reflection (T1059). Command and control is established via application layer protocols (T1071), including MQTT for distribution and HTTP POST for C2 communication. The final stage uses the device as a proxy, which aligns with T1090 (Proxy) for network traffic routing.

Threat Actor Context

Kaspersky attributes this campaign with high confidence to the MoYu Group, an actor previously linked to the BADBOX botnet. BADBOX is known for infecting low-cost Android devices to create a residential proxy network. The MoYu Group's infrastructure and techniques align with this campaign, suggesting a continuation of their botnet-building operations, now targeting automotive head units.

Mitigations & Recommendations

Given the supply-chain nature of this attack, defenders should monitor for unexpected APK installations on Android-based head units, especially those from DoFun or similar vendors. Network-level monitoring for traffic to cardoor[.]cn or other suspicious domains can help detect compromise. For fleet operators, ensure head unit firmware updates are obtained from trusted sources and consider isolating head unit networks from critical vehicle systems. Endpoint protection on head units, if available, should include behavioral detection for dropper and proxy activities. Kaspersky recommends using their solutions, which detect these threats under the names listed above.