[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fJMXbpcWO4I4-h7gk7e2ESwaRM51rlXmVFp5oa-wnAEo":3},{"article":4,"iocs":50,"watch_terms":59,"solutions":60,"lesson":146},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"7f8417bd-84c1-4750-aaf0-3007219a0ae5","Android Car Malware Spreads Through Built-In Updaters for Ad Fraud, Proxy Botnet","android-car-malware-spreads-through-built-in-updaters-for-ad-fraud-proxy-botnet-a06807","Cybersecurity researchers have flagged a new malware family that's specifically designed to infect Android-based vehicle head unit firmware developed by DoFun. Kaspersky, which discovered the threat in June 2026, said the end goal of the malware is to serve a multi-stage downloader to enable ad fraud and creation of a proxy botnet. \"The malware spread through the built-in updaters of","A new malware family targeting Android-based vehicle head units, specifically those developed by DoFun, has been discovered. The malware spreads through legitimate software update mechanisms, acting as a multi-stage downloader for ad fraud and to establish a proxy botnet. This sophisticated attack chain exploits the TWCore system app and has been attributed to the MoYu Group, previously linked to the BADBOX scheme.","New Android car malware exploits built-in updaters for ad fraud and proxy botnets.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002Fandroid-car-malware-spreads-through.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEi1EQE-DqLXTzpjwGf3nQnM4CTnjibkKl_2ersn8abw3Gmqoc5MUaFC2LvkA7c6Xoa0XBPZeHL4wHHiXU7Pc9nGLcI1zTorwFTwvYXfww4Q68oSUrgcQhmBzQBNqYp-woIZFK_I1OOsnBNptiwA90VHhpE_hvlz3qdFomOmOMLreYe5YCenvR2CeawvRrMU\u002Fs1600\u002Fcar.png","2026-08-21T15:41:44+00:00","2026-08-21T18:00:17.54283+00:00",8,[17,20,23,26,29],{"name":18,"type":19},"TWCore","product",{"name":21,"type":22},"DoFun","vendor",{"name":24,"type":25},"MoYu Group","threat_actor",{"name":27,"type":28},"BADBOX","campaign",{"name":30,"type":31},"MQTT","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":32,"icon":34,"name":35,"slug":36},null,"Malware","malware",[38,43,45],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[51,55],{"type":52,"value":53,"context":54},"domain","cardoor[.]cn","Subdomain used for MQTT message broker to download APK files.",{"type":56,"value":57,"context":58},"ip","144.217.243[.]201","IP address hosting the next-stage payload.",[21,18],{"controls":61,"vendors":145},[62,90,116],{"slug":63,"name":64,"problem":65,"products":66},"patch-management","Automated patch management","Known holes get closed in days, not months.",[67,75,82],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":63,"product_name":79,"url":80,"description":81},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":91,"name":92,"problem":93,"products":94},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",[95,103,108],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"airlock-digital","Airlock Digital","\u002Fvendor-logos\u002Fairlock-digital.png","airlock-allowlisting","Airlock Allowlisting and Execution Control","https:\u002F\u002Fwww.airlockdigital.com\u002F","Blocks anything not explicitly trusted from running, with tools to build and keep the trusted list current as software changes.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":104,"product_name":105,"url":106,"description":107},"app-control-for-business","App Control for Business","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fsecurity\u002Fapplication-security\u002Fapplication-control\u002Fapp-control-for-business\u002F","Application control built into Windows, formerly Windows Defender Application Control, with AppLocker as the older option. Policies can be managed through Intune.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","allowlisting","Allowlisting","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fallowlisting","Blocks any software that has not been approved, including ransomware and unapproved remote-access tools. A learning period builds the approved list first.",{"slug":117,"name":118,"problem":119,"products":120},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[121,129,137],{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",[],{"slug":147,"title":148,"body":149,"framework_refs":150,"framework_notes":161},"android-car-head-unit-malware-hijacks-legitimate-updaters-for-ad-fraud-and-proxy-botnet","Android Car Head Unit Malware Hijacks Legitimate Updaters for Ad Fraud and Proxy Botnet","The MoYu Group exploited trusted, built-in software update mechanisms in DoFun-manufactured Android vehicle head units to silently deliver multi-stage malware, turning a trusted process into an attack vector. Because the malware abuses a legitimate system app (TWCore), it bypasses typical user-level security scrutiny and can persist with elevated privileges. This attack mirrors the BADBOX scheme, demonstrating that embedded Android devices in non-traditional form factors — such as automotive systems — are increasingly targeted and often lack the security oversight applied to phones or enterprise endpoints. The consequences extend beyond individual vehicles, as compromised devices are enrolled into proxy botnets and ad fraud networks, generating financial harm at scale.",[151,152,153,154,155,156,157,158,159,160],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 16: Application Software Security","NIST SP 800-161: Supply Chain Risk Management Practices","NIST SP 800-193: Platform Firmware Resiliency Guidelines","NIST CSF DE.CM-7: Monitoring for Unauthorized Software","NIST SP 800-40: Guide to Enterprise Patch Management","ISO\u002FIEC 27036: Information Security for Supplier Relationships","ETSI EN 303 645: Cybersecurity for Consumer IoT (Clause 5.3 — No Universal Default Passwords & Secure Update Mechanisms)","UNECE WP.29 \u002F ISO\u002FSAE 21434: Automotive Cybersecurity Engineering (OTA Update Security)",{}]