Full Report
A supply-chain attack targeting Android-based car head units is using a legitimate device-update app to spread malware that enlists compromised devices in a proxy botnet or uses them for ad fraud. [...]
Analysis Summary
# Incident Report: Supply-Chain Compromise of Android-Based Car Head Units
## Executive Summary
A supply-chain attack targeted Android-based car head units manufactured by DoFun, utilizing a legitimate system update app to distribute malware. Attributed to the "MoYu" threat actor, the malware enlists compromised infotainment systems into a residential proxy botnet and performs automated ad fraud. The attack marks the first documented case of a malware infection chain specifically engineered for automotive head units.
## Incident Details
- **Discovery Date:** June 2026 (Reported August 22, 2026)
- **Incident Date:** Ongoing as of mid-2026
- **Affected Organization:** DoFun (Shenzhen Driving Control Technology Co., Ltd.)
- **Sector:** Automotive / Software Supply Chain
- **Geography:** Global (Targeting Chinese-manufactured hardware)
## Timeline of Events
### Initial Access
- **Date/Time:** Identified June 2026
- **Vector:** Supply-Chain Compromise / Software Update Hijack
- **Details:** Attackers compromised the legitimate DoFun system app "TWCore." This app receives instructions via an MQTT server (cardoor[.]cn) to download a rogue APK.
### Lateral Movement
- **Details:** The malware primarily operates vertically (C2 to device). It downloads a second-stage loader which then retrieves a final encrypted payload from the attacker-controlled server.
### Data Exfiltration/Impact
- **Details:** The malware exfiltrates device metadata (Model, Resolution, Wi-Fi SSID, MAC address). The primary impact is the unauthorized use of the device's internet connection as a proxy node and the execution of background ad-fraud scripts.
### Detection & Response
- **Detection:** Discovered by Kaspersky researchers during analysis of anomalous APK downloads from legitimate system processes.
- **Response:** Kaspersky notified DoFun; DoFun reportedly resolved the issue (though specific remediation details were not disclosed).
## Attack Methodology
- **Initial Access:** Hijacking the "TWCore" system app update mechanism.
- **Persistence:** Implementation as a system-level service ("JarService") with no user interface.
- **Privilege Escalation:** Exploitation of pre-installed system app permissions to install unknown APKs.
- **Defense Evasion:** Use of encrypted payloads, multi-stage loading, and lack of a GUI to remain invisible to the driver.
- **Discovery:** Periodic reporting of device specs (SSID, MAC, hardware model) to C2.
- **Lateral Movement:** Not observed; focused on external proxying.
- **Exfiltration:** Device metadata sent to C2 via HTTP.
- **Impact:** Installation of "zhima" reverse-proxy module and WebView-based ad-click fraud.
## Impact Assessment
- **Financial:** High potential for monetization by the attacker via proxy-as-a-service and ad-revenue theft.
- **Data Breach:** Exposure of local network identifiers (SSIDs) and unique hardware IDs.
- **Operational:** Consumption of vehicle data plans/bandwidth and potential slowing of infotainment system performance.
- **Reputational:** Significant impact on DoFun and Shenzhen Driving Control Technology regarding software integrity.
## Indicators of Compromise
- **Network:**
- cardoor[.]cn (MQTT Server)
- Communication with known MoYu C2 infrastructure.
- **File:**
- TWCore (Compromised system app)
- JarService (Malicious APK)
- zhima (Proxy module)
- **Behavioral:**
- Background HTTP GET/POST requests to advertising domains.
- Unexpected ICMP ping (traceroute) activity.
- Large volumes of encrypted data traffic from the head unit.
## Response Actions
- **Containment:** DoFun claimed to have patched the vulnerability/infrastructure used to push the rogue APK.
- **Eradication:** Removal of the "JarService" and "zhima" modules from affected devices (assumed via OTA update).
- **Recovery:** Restoration of legitimate update services.
## Lessons Learned
- **Supply Chain Fragility:** Even legitimate "system" apps on Android-based hardware can be leveraged to deliver second-stage payloads.
- **Automotive IoT Risks:** As vehicles become more connected, they become attractive targets for "low-stakes" botnet monetization (proxies/ads), even if critical driving functions remain untouched.
- **Monitoring Necessity:** Manufacturers must monitor the integrity of their MQTT and update servers for unauthorized command injection.
## Recommendations
- **Code Signing:** Implement rigorous code-signing requirements for any APK downloaded by system services.
- **Network Segmentation:** Isolate infotainment systems from sensitive vehicle control networks (CAN bus) to prevent future escalation.
- **Traffic Analysis:** Implement EDR-like monitoring for automotive Android builds to flag unexpected outbound proxy traffic or background WebView execution.