Full Report
Cybersecurity researchers have flagged a new malware family that's specifically designed to infect Android-based vehicle head unit firmware developed by DoFun. Kaspersky, which discovered the threat in June 2026, said the end goal of the malware is to serve a multi-stage downloader to enable ad fraud and creation of a proxy botnet. "The malware spread through the built-in updaters of
Analysis Summary
# Tool/Technique: JarService / Android Automotive Malware
## Overview
This malware is a specialized multi-stage downloader designed to target Android-based vehicle head units, specifically those running firmware developed by DoFun. Discovered by Kaspersky in June 2026, the malware leverages legitimate system update channels to infect vehicle infotainment systems. Its primary objectives are to facilitate ad fraud and incorporate the infected hardware into a residential proxy botnet.
## Technical Details
- **Type:** Malware family (Dropper/Downloader)
- **Platform:** Android-based Automotive Head Units (DoFun firmware)
- **Capabilities:** Multi-stage payload delivery, ad fraud, proxy botnet creation, device data exfiltration.
- **First Seen:** June 2026 (variants traced back to earlier versions, e.g., "3.57").
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- **[T1474 - Supply Chain Compromise]**: Abuse of the legitimate "TWCore" system update mechanism.
- **[TA0002 - Execution]**
- **[T1204.001 - User Execution]**: Though triggered via system apps, it installs as a user application.
- **[TA0003 - Persistence]**
- **[T1543.003 - Create or Modify System Process]**: Integration into the firmware update lifecycle.
- **[TA0005 - Defense Evasion]**
- **[T1406 - Obfuscation]**: Use of a multi-stage loading process and masquerading as system updates.
- **[TA0011 - Command and Control]**
- **[T1071.001 - Web Protocols]**: Use of HTTP POST requests for C2 communication.
## Functionality
### Core Capabilities
- **Weaponized Update Channel:** Exploits the "TWCore" (`com.tw.core`) system app which uses an MQTT message broker to download APKs to `/push/apk/`.
- **Multi-stage Loading:** Uses the **JarService** dropper to fetch and execute a secondary loader.
- **Payload Retrieval:** Downloads encrypted or masqueraded payloads (e.g., `dex3.68.png`) from remote servers.
### Advanced Features
- **Proxy Botnet:** Converts the vehicle's internet connection (via built-in SIM) into a residential proxy node.
- **Dynamic Configuration:** Polls the C2 server every 90 minutes; if the configuration is outdated, it receives new C2 addresses and task paths.
- **Command Mapping:** Uses the SharedPreferences API to store command identifiers (productId) mapped to specific malicious JSON-serialized tasks.
## Indicators of Compromise
- **File Names:**
- `TWCore` (`com.tw.core`) - *Note: This is a legitimate app weaponized by the actors.*
- `JarService` (Dropper)
- `dex3.68.png` (Malicious DEX payload)
- **Network Indicators:**
- `cardoor[.]cn` (Subdomain used for MQTT broker)
- `144.217.243[.]201` (Payload delivery server)
- `/cpc/api/task` (C2 endpoint)
- **Behavioral Indicators:**
- Unexpected APK installations in `/push/apk/`.
- Background HTTP POST traffic to external IPs every 90 minutes.
- High data usage originating from automotive head units without user interaction.
## Associated Threat Actors
- **MoYu Group** (also associated with the **BADBOX** botnet operations).
## Detection Methods
- **Signature-based detection:** Scanning for known hashes of the `JarService` dropper and associated `dex` payloads.
- **Behavioral detection:** Monitoring for unauthorized calls to the `SharedPreferences` API by apps without a UI, or monitoring MQTT traffic for unusual update commands.
- **Network Monitoring:** Flagging communication with the `cardoor[.]cn` domain or known BADBOX infrastructure.
## Mitigation Strategies
- **Firmware Hardening:** Ensure that system update apps (like TWCore) validate the cryptographic signatures of all downloaded APKs before installation.
- **Network Segmentation:** If possible, restrict head unit internet access to known-good domains required for navigation and official updates.
- **Patch Management:** Apply the latest firmware updates from DoFun, as the specific vulnerability used for distribution has reportedly been addressed.
## Related Tools/Techniques
- **BADBOX:** A broader botnet scheme involving ad fraud and residential proxies.
- **IPTV Backdoors:** Similar delivery methods used by the same threat actors to infect Android-based TV boxes.