Skip to main content
IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Exposure
4 IOCs

BADBOX-Linked MoYu Hackers Abuse Android Car Head Unit Updates to Build Proxy Botnet

Cyber Press
Cyber Press
Published August 24, 2026Original Report

Excerpt

Security researchers have uncovered the first documented malware campaign specifically targeting Android-based automotive head units, attributing the operation with high confidence to MoYu Group, a threat actor tied to the notorious BADBOX botnet. The discovery marks a significant escalation as botnet operators expand beyond smartphones, smart TVs, and set-top boxes into in-vehicle infotainment systems, echoing trends seen in other covert malware campaigns infiltrating…

Read the original report →

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYunknownINFRASTRUCTUREadmin.uipoxy.comkshahnd.sbscardoor.cnCAPABILITYunknownVICTIMunknown
Adversary
Infrastructure(4)
Capability
Victim

Indicators of Compromise

Open the mindmap →

4 indicators

TypeIndicatorConfidenceScoreFirst Seen
Domainadmin.uipoxy.comHighScore 58/100First seen
Domainkshahnd.sbsHighScore 64/100First seen
Domaincardoor.cnHighScore 63/100First seen
Domainmdsjhd.sbsHighScore 64/100First seen

IOC Relationship Graph

Building graph…