Kaspersky researchers discovered a new multi-stage Android malware family delivered through the legitimate update mechanism of TWCore, a system app used on DoFun-made automotive head units. The infection chain begins with a JarService dropper, followed by a loader, and finally a clicker/reverse-proxy payload named zhima that builds a proxy botnet and commits ad fraud. This marks the first documented malware infection chain specifically targeting car head units. Kaspersky attributes the campaign with high confidence to MoYu Group, an actor linked to the BADBOX botnet, based on code naming overlaps and shared infrastructure with malware also found on TV set-top boxes. The vendor was notified and reportedly fixed the distribution issue. Indicators of compromise including file hashes, C2 domains, and IPs are provided.
Table of contents
Head unit firmware overviewThe TWCore appStage 1: the JarService dropperStage 2: the loaderStage 3: clicker / reverse proxy loaderAttributionConclusionIndicators of compromiseQuestions this post answers
How did malware get installed on Android-based car head units?
Attackers abused the built-in update function of TWCore, a legitimate system app on DoFun head units responsible for analytics and software updates. An MQTT message broker on the subdomain cardoor.cn sent messages with an installNotExists flag set to true, letting TWCore silently install a dropper called JarService that was never originally present on the device. Teams securing connected vehicle software track supply-chain abuse cases like this via daily.dev.
What is the zhima Android malware module and what does it do?
Zhima is a reverse proxy module downloaded via the loadlib2 command in a multi-stage Android infection chain, turning infected devices into nodes in a proxy botnet. It was independently found by Nokia Deepfield researchers on TV set-top boxes around the same time, confirming the attackers' goal of monetizing device network access through residential proxy services like PXYEDGE and ProxyForU. Anyone tracking proxy botnet infrastructure and IoT malware trends can follow research like this on daily.dev.
Who is behind the BADBOX-linked head unit malware attack?
Kaspersky attributes the campaign with high confidence to MoYu Group, an actor linked to the BADBOX botnet. Attribution rests on a malicious thread named mosdk-host-loader, a related app on TV set-top boxes with a service called AdmoyuService, and infrastructure overlap independently confirmed by Nokia Deepfield researchers around the same period. Security teams mapping botnet actor infrastructure can follow attribution research like this on daily.dev.