A supply-chain attack has compromised Android-based car head units, leveraging a legitimate device-update application to distribute malware that enlists affected devices into a proxy botnet or uses them for ad fraud. Cybersecurity researchers attribute the operation to the MoYu group, a threat actor previously linked to the BadBox malware botnet. This incident marks the first documented instance of a malware infection chain specifically designed for car head units.
The MoYu group's operation targets systems from DoFun, a Chinese automotive software and hardware provider owned by Shenzhen Driving Control Technology Co., Ltd. DoFun supplies generic Android-based head units, which serve as the central control for a car's infotainment, navigation, and settings.
In June, researchers identified a rogue APK file being downloaded from TWCore, a legitimate DoFun system app that receives instructions via an MQTT server hosted at cardoor[.]cn. This unknown app, named JarService, operates without a user interface and functions as malware.
Upon execution, JarService decrypts and launches a second-stage loader. This loader establishes communication with a command-and-control (C2) server to download an additional encrypted payload. The final payload regularly transmits device information, including model, display resolution, Wi-Fi SSID, and MAC address, and receives commands from the attackers.
The malware supports nine distinct commands: `return` (retrieves a specified value from Android's SharedPreferences storage), `copy` (copies content to the device clipboard), `http` (sends HTTP GET or POST requests and can save parts of the response), `web` (opens a URL in a WebView and executes supplied JavaScript), `loadlib` and `loadlib3` (not fully implemented), `loadlib2` (downloads and executes arbitrary code or additional modules), `deeplink` (opens a specified resource in the browser), and `traceroute` (checks host reachability using ICMP ping).
Analysis indicates that the malware does not interfere with driving or critical vehicle control systems. Its primary objective appears to be advertising fraud and monetizing internet-connected car head units by converting them into residential proxy nodes. Researchers observed that the operators predominantly loaded a reverse-proxy module called `zhima`, transforming the head unit into a proxy botnet node, and also initiated web requests for click-fraud activities.
The researchers informed DoFun of their findings. DoFun confirmed that it had resolved the issue. The initial compromise vector remains unconfirmed.
