[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fSUQDsuenp-M3LHrmjInjtpkm2L8l1mgeZTTv2QRN6ak":3},{"article":4,"iocs":54,"watch_terms":59,"solutions":60,"lesson":147},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"5c99227b-537d-4739-b1bb-70f4a8461f3d","Hackers infect Android car head units with proxy botnet malware","hackers-infect-android-car-head-units-with-proxy-botnet-malware-6966ac","A supply-chain attack targeting Android-based car head units is using a legitimate device-update app to spread malware that enlists compromised devices in a proxy botnet or uses them for ad fraud. [...]","A supply-chain attack has been discovered where hackers are infecting Android-based car head units using a legitimate device-update app. The malware, attributed to the MoYu group, turns compromised devices into proxy botnet nodes or uses them for ad fraud, without interfering with critical driving systems.","Hackers infect Android car head units via a supply-chain attack using a legitimate update app.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhackers-infect-android-car-head-units-with-proxy-botnet-malware\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F08\u002F21\u002Fcar.jpg","2026-08-22T14:14:24+00:00","2026-08-22T16:00:22.35706+00:00",8,[17,20,23,26,28],{"name":18,"type":19},"MoYu","threat_actor",{"name":21,"type":22},"BadBox","product",{"name":24,"type":25},"DoFun","vendor",{"name":27,"type":22},"TWCore",{"name":29,"type":30},"Android","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":31,"icon":33,"name":34,"slug":35},null,"Malware","malware",[37,42,47,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":48},{"id":31,"icon":33,"name":34,"slug":35},{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55],{"type":56,"value":57,"context":58},"domain","cardoor[.]cn","MQTT server host for DoFun system app TWCore",[24,21,27],{"controls":61,"vendors":146},[62,90,119],{"slug":63,"name":64,"problem":65,"products":66},"patch-management","Automated patch management","Known holes get closed in days, not months.",[67,75,82],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":63,"product_name":79,"url":80,"description":81},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":91,"name":92,"problem":93,"products":94},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[95,103,111],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"slug":120,"name":121,"problem":122,"products":123},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[124,132,140],{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",{"vendor_slug":141,"vendor_name":142,"vendor_logo":143,"product_slug":141,"product_name":142,"url":144,"description":145},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png","https:\u002F\u002Fsocket.dev\u002F","Detects and blocks malicious and risky packages in npm, PyPI and other ecosystems.",[],{"slug":148,"title":149,"body":150,"framework_refs":151,"framework_notes":162},"supply-chain-attack-hijacks-android-car-head-units-via-trojanized-update-app","Supply-Chain Attack Hijacks Android Car Head Units via Trojanized Update App","Attackers compromised the software supply chain by weaponizing a legitimate device-update application to silently install proxy botnet malware on Android-based car head units. This attack demonstrates how trusted update mechanisms can become a critical attack vector when the integrity of the update pipeline is not verified. Because the malware operates covertly — redirecting traffic or committing ad fraud without disrupting driving functions — owners and fleet operators are unlikely to notice the compromise. This matters because millions of embedded consumer devices with persistent internet connectivity and weak security controls can be silently recruited into large-scale botnets, amplifying criminal infrastructure at the expense of unsuspecting users.",[152,153,154,155,156,157,158,159,160,161],"CIS Control 2 – Inventory and Control of Software Assets","CIS Control 7 – Continuous Vulnerability Management","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-161 – Supply Chain Risk Management","NIST SP 800-193 – Platform Firmware Resiliency Guidelines","NIST SI-7 – Software, Firmware, and Information Integrity","NIST SA-12 – Supply Chain Protection","NIST IR-4 – Incident Handling","GDPR Article 32 – Security of Processing (for any PII transmitted through compromised units)","ENISA Good Practices for Supply Chain Cybersecurity",{}]