Car head units hijacked for proxy botnet abuse

Forget the engine or the brakes: the latest cyber threat to a vehicle could sit inside its dashboard. Security researchers have uncovered a supply-chain attack that plants malware on Android-based car head units, turning the infotainment center into a cog in a proxy botnet or a tool for ad fraud.

Supply chain hits DoFun head units

Kaspersky researchers analyzed the malware and attribute the operation to the MoYu group, a threat actor previously linked to the BadBox malware botnet. The researchers note that this is the first documented case of a malware infection chain specifically created for a targeted car head unit.

MoYu's operation targets systems from DoFun, a Chinese automotive software and hardware provider owned by Shenzhen Driving Control Technology Co., Ltd. DoFun sells generic Android-based head units, which act as the command center for a car's infotainment, navigation, and settings systems.

The malware rides on a legitimate DoFun app called TWCore, which receives instructions through an MQTT server hosted at cardoor[.]cn. This app is used to update device software, making it a perfect vehicle for the attack.

Stealthy JarService malware discovered

In June, Kaspersky researchers found a rogue APK file being downloaded from the TWCore app. The unknown app has no interface and is a piece of malware called JarService. When launched, the malware decrypts and executes a second-stage loader that establishes communication with a command-and-control (C2) server and downloads another encrypted payload.

The final payload periodically reports device information such as the model, display resolution, Wi-Fi SSID, and MAC address, and retrieves commands from the attackers. This setup gives the attackers a persistent foothold in the head unit.

Nine commands, many malicious uses

The malware supports nine commands, each designed to give the attackers control over the device. The commands include:

• return – retrieves a specified value from Android's SharedPreferences storage
• copy – copies stored or downloaded content to the device clipboard
• http – sends HTTP GET or POST requests and can save part of the response
• web – opens a URL in a WebView and executes supplied JavaScript
• loadlib – not fully implemented when Kaspersky published the report
• loadlib2 – downloads and executes arbitrary code or additional modules
• loadlib3 – not fully implemented when Kaspersky published the report
• deeplink – opens a specified resource in the browser
• traceroute – checks whether specified hosts are reachable using ICMP ping

These commands allow the attackers to manipulate the device in various ways, but notably, the malware does not interfere with driving or critical vehicle control systems. Kaspersky says the malware appears designed for advertising fraud and turning internet-connected car head units into residential proxy nodes for monetization purposes.

Turning infotainment into a proxy node

Researchers discovered that the operator primarily loaded a reverse-proxy module named 'zhima,' which turns the head unit into a proxy botnet node, and also made web requests for click-fraud activity. This means the attacker can route internet traffic through the compromised head unit, potentially masking malicious activity behind a legitimate IP address.

The use of a proxy botnet is a lucrative business, and car head units make attractive targets because they are always connected and often have less security than other devices. The attack appears financially motivated, not aimed at causing physical harm.

DoFun responds, but questions remain

Kaspersky says it notified DoFun of its findings, and the Chinese firm replied that it resolved the problem. However, BleepingComputer has contacted both companies with questions about the initial compromise vector, and we will update the article with the information once received.

The fact that DoFun acknowledged the problem suggests some action was taken, but the specifics of the attack remain unclear. The compromise vector—how the attackers managed to inject the malicious APK into the TWCore app—is still unknown.

Why it matters: your car could be part of a botnet

This incident highlights a growing threat surface: vehicles are no longer just mechanical machines but are increasingly software-defined. As cars become more connected, the risk of them being used for malicious purposes grows. For consumers, this means the infotainment system could be quietly abused for cybercrime without any visible sign. For manufacturers, it underscores the need for robust supply chain security and regular security audits.

The MoYu group's shift to car head units suggests that botnet builders are expanding beyond traditional devices. Since the malware focuses on ad fraud and proxy services, the impact is mainly on the device's internet connection and network resources, not on driving safety. Still, it's a reminder that even mundane components of a car can become compromised.