BADBOX Botnet Hacked 74,000 Android Devices With Customizable Remote Codes

BADBOX is a cybercriminal operation infecting Android devices like TV boxes and smartphones with malware before sale, which are often sold through reputable retailers and pose a significant threat to users due to their pre-installed malicious software, making detection challenging.

It previously thought eradicated has resurfaced with a significantly expanded reach, infecting over 192,000 Android devices, including smart TVs and smartphones from various manufacturers, primarily targeting users in Russia, China, India, Belarus, Brazil, and Ukraine. 

Stealthy Android TV malware, likely derived from Triada, compromises devices before sale, granting remote access to attackers, which was discovered in April 2023 and linked to the PEACHPIT botnet.

It leverages compromised devices for nefarious activities like proxying, remote code execution, and ad fraud, which can silently install additional malicious modules, enabling threat actors to launch new attacks. 

Free Webinar on Best Practices for API vulnerability & Penetration Testing:  Free Registration

The device, compromised by malicious firmware, automatically connects to a harmful network upon booting to receive and execute backdoors, which can then download and install additional malicious payloads without user authorization, enabling the attackers to carry out various undetected and evolving attacks.

Recent operations, such as the German disruption of 30,000 BADBOX-infected devices, have only temporarily slowed the botnet’s spread.

Bitsight’s sinkholing efforts revealed over 160,000 unique IPs, including 100,000 from high-end Yandex 4K QLED Smart TVs, demonstrating the botnet’s persistent threat and its expansion beyond low-cost devices.

The malware infected high-end Yandex 4K Smart TVs, compromising their security and enabling potential remote control, which marks a significant expansion of the malware’s target range beyond typical Android devices.

Yandex Smart TVs and T963 smartphones are compromised, with over 160,000 unique IPs communicating daily, which are linked to a recently registered Swiss Yandex branch, are leaking user data, as evidenced by the disclosed MAC addresses and increasing traffic volume.

YNDX Smart TVs dominate traffic, originating mostly from Russia. Hisense phones follow, with lower activity from other regions, which aligns with the limited sales reach of YNDX TVs, confirmed by the manufacturer’s website – they primarily target Russia and neighboring countries.  

An investigation linked IPs to BADBOX C2 domains through shared URI paths and identified new potential C2 domains by SSL thumbprint analysis. 

Two active domains showed BADBOX behavior and high pDNS requests, while others (yydsmd.com, etc.) used a different communication format (/ota/api/), suggesting a potential new BADBOX tactic. 

BADBOX malware, a global threat, leverages supply chains to infect various Android devices, including those from reputable brands like Yandex and Hisense, highlighting the growing sophistication of cybercriminals and the importance of vendor and partner trust to mitigate risks of data breaches and potential involvement in malicious activities. 

Investigate Real-World Malicious Links, Malware & Phishing Attacks With ANY.RUN – Try for Free