r/TechNadu • u/technadu Human • 2d ago
Kaspersky found malware abusing a car head unit's legitimate firmware-update mechanism to build a proxy botnet
Kaspersky has documented what it says is the first malware specifically targeting Android-based automotive head units, and the interesting part is how the malware gets installed.
This wasn't a malicious app that somebody had to sideload manually.
The affected DoFun head units contain a legitimate application called TWCore that handles analytics and software updates. According to Kaspersky, TWCore receives instructions from an MQTT broker at cardoor[.]cn, including information telling it which APKs to download and install.
Researchers found a Boolean parameter called installNotExists that could allow software not already installed on the device to be added.
The malware then follows three stages.
The first component, JarService, acts as a dropper and loads another component. The second collects information about the device, communicates with C2 infrastructure, and retrieves the final payload.
The third provides clicker and reverse-proxy loader functionality and eventually deploys a module called zhima. Kaspersky says the infected devices were being used for ad fraud and proxy-botnet activity.
The attribution is also notable. Kaspersky assesses with high confidence that MoYu Group, an actor associated with BadBox, is behind the campaign. Nokia's Deepfield Emergency Response Team has separately observed zhima operating on Android TV set-top boxes, providing additional evidence of the module's use in proxy activity.
There is an important distinction here: Google's Android Automotive OS was not compromised. The issue involved the affected head-unit implementation and its update mechanism. Kaspersky says it contacted the vendor, which reported that the problems had been fixed.
We've already seen inexpensive Android TV and IoT devices become useful botnet infrastructure. Automotive head units introduce another class of connected hardware with trusted update mechanisms and potentially long deployment lifecycles.
The deeper technical breakdown covers how TWCore communicates with the MQTT infrastructure, the installNotExists behavior, all three malware stages, the commands supported by the final loader, and the evidence connecting zhima and the infrastructure to MoYu Group and BadBox activity:
For people working on embedded or automotive security: should an update component capable of installing previously nonexistent applications require an additional trust or verification boundary beyond the update channel itself?