Android Head Unit Malware Turns Vehicle Infotainment Systems into Proxy Botnets

The infection enters via TWCore, a legitimate system application embedded in firmware supplied by DoFun, a Chinese vendor of infotainment software. For technicians servicing imports with Android-based head units, the finding repositions the OTA update pathway from a maintenance convenience into a primary attack surface.

Delivery path and the TWCore flaw

TWCore functions as an analytics collector and update dispatcher for the head unit. The application pulls instructions from a message broker hosted at cardoor[.]cn, which returns object descriptors specifying which application files the head unit should download and execute. Among the descriptor fields sits installNotExists, a Boolean flag. When set to true, TWCore is permitted to install applications that were never present on the device at the factory.

That single flag converts the update channel into an arbitrary code-execution pipeline. No user interaction is required. No certificate mismatch surfaces. The installer behaves as designed. The payload, however, is selected by the attacker, not the manufacturer.

Kaspersky attributes the operation, with high confidence, to the MoYu Group, an actor previously linked to the BADBOX botnet — a network of consumer devices shipped with a firmware backdoor already embedded in the supply chain.

Three-stage payload structure

The malware executes in discrete layers. Stage one is JarService, a minimal dropper whose sole function is unpacking the next stage. Stage two is a loader that transmits baseline device telemetry to a remote server and retrieves a versioned download link for the subsequent payload. Researchers enumerated seven distinct payload variants by iterating the version field, indicating sustained operation and iterative development.

Stage three establishes a persistent command channel. The infected head unit contacts the command server every 90 minutes, transmitting screen resolution, device model, the SSID of the connected Wi-Fi network, and the MAC address. Nine distinct commands are embedded in the binary. Two have been observed in active use. The first, loadlib2, retrieves zhima, the reverse-proxy module that completes the botnet integration. The second, http, supports standard proxy traffic relay.

Researchers at Nokia's Deepfield team independently identified the same zhima module on compromised TV set-top boxes during the same operational window, reinforcing the assessment that the actors' objective is the construction of a cross-platform proxy botnet rather than vehicle-specific data theft.

Verification baseline

DoFun, after responsible disclosure by Kaspersky, states that the exploited gap has been closed. For the technician, verification proceeds through the following checks.

• Identify the firmware origin. Units running DoFun-supplied software are the affected cohort. Confirm vendor and firmware build through the head unit's system information screen.
• Inspect the installed application list. TWCore should be present. Any additional package whose name does not correspond to a documented vendor deliverable warrants forensic capture.
• Audit network egress. A head unit transmitting to cardoor[.]cn, or to non-manufacturer endpoints on port 80 or 443 without an active update operation, indicates compromise.
• Confirm update behavior post-fix. Patched firmware should reject installNotExists=true descriptors. A unit that continues to accept and execute unknown APK payloads from the update channel has not received the corrected build.

The infected unit shows no drivability symptom. No warning lamp illuminates. The fault manifests entirely in the network layer, which is precisely where the diagnostic must extend.