Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
4 IOCs
BADBOX-Linked MoYu Hackers Abuse Android Car Head Unit Updates to Build Proxy Botnet
Excerpt
Security researchers have uncovered the first documented malware campaign specifically targeting Android-based automotive head units, attributing the operation with high confidence to MoYu Group, a threat actor tied to the notorious BADBOX botnet. The discovery marks a significant escalation as botnet operators expand beyond smartphones, smart TVs, and set-top boxes into in-vehicle infotainment systems, echoing trends seen in other covert malware campaigns infiltrating…
Read the original report →Diamond Model
Adversary
Infrastructure(4)
Capability
Victim
Indicators of Compromise
Open the mindmap →4 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | admin.uipoxy.com | High | Score 58/100 | First seen |
| Domain | kshahnd.sbs | High | Score 64/100 | First seen |
| Domain | cardoor.cn | High | Score 63/100 | First seen |
| Domain | mdsjhd.sbs | High | Score 64/100 | First seen |
IOC Relationship Graph
Building graph…