[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f3w70ZKSGu-lUquRba0YQt-eYuIxLYV2m1T4nz0T0RkA":3},{"article":4,"iocs":46,"watch_terms":50,"solutions":51,"lesson":137},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"ebca8f13-0ce7-4013-b436-3ddc68ed1c74","First Malware Built Specifically for Car Head Units Fuels Botnet","first-malware-built-specifically-for-car-head-units-fuels-botnet-79bece","Kaspersky researchers have linked the malware to the BadBox botnet, which has ensnared millions of devices. The post First Malware Built Specifically for Car Head Units Fuels Botnet appeared first on SecurityWeek.","Kaspersky researchers have identified the first malware specifically designed for car head units, exploiting a vulnerability in the software update system of DoFun infotainment systems. This malware is linked to the BadBox botnet, which has already compromised millions of Android devices, and suggests an expansion of the threat actors' targeting methods beyond budget devices.","New malware targets car head units, fueling the BadBox botnet with millions of devices.","https:\u002F\u002Fwww.securityweek.com\u002Ffirst-malware-built-specifically-for-car-head-units-fuels-botnet\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2020\u002F01\u002Fcar-interior-e1787656605560.jpg","2026-08-25T11:18:22+00:00","2026-08-25T12:00:07.54207+00:00",8,[17,20],{"name":18,"type":19},"DoFun","vendor",{"name":21,"type":22},"MoYu Group","threat_actor","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":23,"icon":25,"name":26,"slug":27},null,"Malware","malware",[29,34,36,41],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":35},{"id":23,"icon":25,"name":26,"slug":27},{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[47],{"type":27,"value":48,"context":49},"BadBox","Malware family linked to the car head unit malware",[18],{"controls":52,"vendors":136},[53,82,107],{"slug":54,"name":55,"problem":56,"products":57},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[58,66,74],{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":83,"name":84,"problem":85,"products":86},"patch-management","Automated patch management","Known holes get closed in days, not months.",[87,95,103],{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":83,"product_name":104,"url":105,"description":106},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":108,"name":109,"problem":110,"products":111},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[112,120,128],{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",[],{"slug":138,"title":139,"body":140,"framework_refs":141,"framework_notes":153},"first-car-head-unit-malware-expands-badbox-botnet-to-in-vehicle-infotainment-systems","First Car Head Unit Malware Expands BadBox Botnet to In-Vehicle Infotainment Systems","Threat actors exploited a vulnerability in the software update mechanism of DoFun infotainment systems to deploy the first malware specifically designed for automotive head units, tying compromised vehicles into the BadBox botnet. This attack highlights how the attack surface for botnets is rapidly expanding beyond traditional consumer electronics into embedded systems in vehicles, where security patching is often infrequent or ignored. The exploitation of the update pipeline itself is particularly dangerous, as it subverts a trusted channel that users and manufacturers rely upon for security fixes. As connected vehicles become more prevalent, insecure software update processes in automotive components represent a critical and largely underappreciated risk vector.",[142,143,144,145,146,147,148,149,150,151,152],"CIS Control 2 – Inventory and Control of Software Assets","CIS Control 7 – Continuous Vulnerability Management","CIS Control 12 – Network Infrastructure Management","CIS Control 16 – Application Software Security","NIST SP 800-82 – Guide to ICS\u002FOT Security","NIST SP 800-193 – Platform Firmware Resiliency Guidelines","NIST CSF DE.CM-4 – Malicious Code Detection","NIST SA-12 – Supply Chain Protection","ISO\u002FSAE 21434 – Road Vehicles Cybersecurity Engineering","UNECE WP.29 R155 – Cyber Security Management System for Vehicles","NIST SI-2 – Flaw Remediation",{}]