BADBOXMalware
According to BitSight, BADBOX is a large-scale cybercriminal operation selling off-brand Android TV boxes, smartphones, and other Android electronics with preinstalled malware.From MISP Galaxy
Last reported 10 days ago, by Malwarebytes Labs2 reports
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
AI worms could spread across your smart devices, Anthropic warns“BADBOX 2.0 illustrates another form of abuse: compromised consumer devices used for activities including residential proxy services, which route other people’s traffic through victims’ internet connections.”
-
The invisible passenger in your car“We attribute this activity, with high confidence, to the MoYu Group, an actor linked to the BADBOX botnet.”
Indicators in its reports
named in the reports above- trojan-dropper.androidos.agent[.]vuin 1 report
- cardoor[.]cnin 1 report
- com[.]twin 1 report
- hxxp://144.217.243[.]201/vr34der34/dex3.68.pngin 1 report
- 144.217.243[.]201in 1 report
- hxxp://t2.kshahnd[.]sbsin 1 report
- t2.kshahnd[.]sbsin 1 report
- hxxp://t2.mdsjhd[.]sbsin 1 report
- t2.mdsjhd[.]sbsin 1 report
- hxxp://t2.nmnsny[.]sbsin 1 report
- t2.nmnsny[.]sbsin 1 report
- hxxps://t2.nmnsny[.]sbsin 1 report
- hxxp://a2.kshahnd[.]sbsin 1 report
- a2.kshahnd[.]sbsin 1 report
- hxxp://a2.mdsjhd[.]sbsin 1 report
- a2.mdsjhd[.]sbsin 1 report
- hxxp://a2.nmnsny[.]sbsin 1 report
- a2.nmnsny[.]sbsin 1 report
- hxxps://a2.nmnsny[.]sbsin 1 report
- hxxp://144.217.243[.]201/vr34der34/sh65.ioin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.