Android Head Unit Firmware - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/android-head-unit-firmware/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 21 Aug 2026 16:30:28 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgMoYu Group Exploits Automotive Firmware Update Mechanism for Botnet Deploymenthttps://feed.craftedsignal.io/briefs/2026-08-android-car-malware/Fri, 21 Aug 2026 16:30:28 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-android-car-malware/The MoYu Group is targeting DoFun Android-based vehicle head units by weaponizing the legitimate TWCore system update application to distribute JarService malware, turning automotive hardware into nodes for ad fraud and proxy botnets.Cybersecurity researchers have identified a campaign targeting Android-based automotive head units manufactured by DoFun. Discovered by Kaspersky in June 2026, the activity involves the abuse of the legitimate "TWCore" (com.tw.core) system application responsible for firmware updates and analytics. The MoYu Group, linked to the broader BADBOX ad fraud and proxy botnet scheme, weaponized the device's MQTT-based update channel to deliver a malicious dropper named JarService. This multi-stage infection allows attackers to establish persistent command-and-control communication, exfiltrate sensitive device information (including MAC addresses and Wi-Fi identifiers), and execute arbitrary commands or modules. By leveraging the head unit's internet connectivity and Android-based environment, attackers repurpose vehicle hardware as residential proxy nodes and ad fraud engines. This represents the first documented case of an infection chain specifically tailored to automotive head unit firmware update mechanisms.

Attack Chain

  1. The attacker utilizes the legitimate system application TWCore (com.tw.core) to initiate a firmware check via a compromised MQTT message broker hosted at cardoor.cn.
  2. The update mechanism triggers an automatic download of a malicious APK file to the directory <TWCore external cache dir>/push/apk/.
  3. The JarService dropper is executed on the Android automotive head unit, bypassing standard application installation prompts.
  4. JarService initiates an HTTP POST request to the hardcoded C2 infrastructure at 144.217.243.201 to report implant metadata.
  5. The C2 server returns a download link for the secondary payload, identified by versioned filenames such as "dex3.68.png".
  6. The secondary payload is deployed as a background user application without a user interface to maintain persistence.
  7. The malware beacons to the C2 endpoint "/cpc/api/task" every 90 minutes, retrieving updated configurations or command identifiers (productIds).
  8. Attackers issue commands to the vehicle head unit to perform ad fraud, execute JavaScript in a WebView, or install the "zhima" reverse proxy module for botnet traffic.

Impact

The compromise of vehicle head units facilitates large-scale ad fraud and the creation of residential proxy networks. Because these units possess persistent internet connectivity via SIM slots, they serve as high-availability nodes for botnet operators. Successful exploitation allows attackers to steal device hardware identifiers and execute arbitrary code on the vehicle's multimedia system, potentially exposing the user's Wi-Fi network and internal connectivity to malicious traffic routing.

Recommendation

  • Monitor network traffic for connections to the domain cardoor.cn or the IP 144.217.243.201 and block these at the enterprise DNS resolver or firewall.
  • Audit installed APKs on vehicle head unit firmware for the presence of the "JarService" dropper and the "zhima" reverse proxy module.
  • Contact the automotive vendor to verify the integrity of the firmware update channel and ensure that the TWCore MQTT broker is not communicating with unauthorized domains.
  • Restrict network communication from automotive head units to only known, verified update servers to prevent unauthorized remote module downloads.
]]>highthreat