MoYu Group - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/actors/moyu-group/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 21 Aug 2026 13:15:58 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgMoYu Group Targets Android Automotive Head Units via Compromised Firmware Updateshttps://feed.craftedsignal.io/briefs/2026-08-android-head-unit-malware/Fri, 21 Aug 2026 13:15:58 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-android-head-unit-malware/The MoYu Group is distributing multi-stage Android malware through compromised firmware updates on DoFun head units to facilitate ad fraud and proxy botnet recruitment.Kaspersky researchers identified a sophisticated campaign attributed to the MoYu Group, an actor previously linked to the BADBOX botnet, targeting Android-based automotive head units. The attack leverages the legitimate TWCore system application, responsible for analytics and OTA updates, to deliver malicious payloads. Attackers utilize an MQTT message broker hosted on the domain cardoor.cn to send instructions to the TWCore application, which then automatically downloads and installs arbitrary APKs on the head unit.

The malware, identified as a multi-stage downloader (JarService), operates silently without a user interface. Its primary objectives include ad fraud and the recruitment of the compromised head units into a proxy botnet, taking advantage of the always-online nature and SIM capabilities of these automotive systems. This represents a significant shift in IoT targeting, moving from conventional devices to automotive entertainment systems. The vendor, DoFun, has been notified and has released fixes for the update distribution mechanism.

Attack Chain

  1. Attackers maintain an MQTT broker on the attacker-controlled infrastructure (cardoor.cn).
  2. The compromised TWCore system app on the DoFun head unit connects to the MQTT broker for update instructions.
  3. The MQTT broker transmits a message containing a download URL and an installNotExists boolean flag to force installation.
  4. TWCore downloads the malicious APK to its external cache directory at <TWCore external cache dir>/push/apk/.
  5. The JarService dropper is executed, which decrypts internal XOR-encrypted blocks to reveal secondary stage payloads.
  6. The secondary stage payload (a loader) initiates communication with the C2 server via an HTTP POST request, transmitting device and implant metadata.
  7. The loader uses reflection to execute the stage 3 payload, establishing proxy botnet functionality and ad fraud routines.

Impact

The campaign results in the recruitment of automotive head units into a large-scale proxy botnet and facilitates unauthorized ad fraud. This compromises the integrity of the vehicle's embedded system, potentially leading to increased data usage costs for users and the abuse of vehicle connectivity for malicious traffic routing.

Recommendation

  1. Monitor network traffic for connections to cardoor.cn, which serves as the MQTT infrastructure for the malicious update instructions.
  2. Audit Android head unit firmware and update channels to ensure software is only retrieved from legitimate, verified manufacturer endpoints.
  3. Deploy detection logic for unauthorized package installation activity originating from the com.tw.core package name.
  4. Block communication to known malicious infrastructure used by the MoYu Group in the proxy botnet operations.
  5. If managing large fleets of Android-based automotive systems, restrict outbound MQTT connections to only known, authenticated manufacturer brokers.
]]>highthreat