MoYu Group Infects Android Car Systems with Malware
MoYu Group Abuses Car Head Units for Proxy Botnet
Related Entities
Threat Actors
Organizations
Products & Tech
Other
Full Report
Executive Summary
Security researchers have uncovered a novel malware campaign attributed to the MoYu Group that targets Android-based in-vehicle infotainment (IVI) systems, also known as head units. The campaign specifically affects devices from manufacturer DoFun. In a significant evolution of IoT Security threats, the attackers are not exploiting an OS vulnerability but are instead abusing a legitimate, pre-installed system application called TWCore. This app, intended for analytics and updates, is being used to silently download and install malware named JarService. The malware operates without a user interface and ultimately transforms the infected car into a node in a proxy botnet, allowing threat actors to route their internet traffic through the vehicle's connection.
Threat Overview
This campaign represents the first documented case of malware infecting car head units through a purpose-built attack vector that leverages trusted pre-installed software. The threat actor, MoYu Group, has been previously associated with the BadBox malware operation, indicating a history of compromising Android devices. The current attack focuses on head units made by DoFun, a Chinese automotive hardware and software provider. By compromising the TWCore application's update mechanism, the attackers can achieve persistence and execute code without user interaction or awareness, a significant step up from attacks requiring physical access.
Technical Analysis
The attack chain is a clear example of a Supply Chain Attack at the software level:
- Initial Vector: The MoYu Group compromises the distribution mechanism of the legitimate
TWCoresystem application, which is pre-installed on DoFun head units. This aligns with MITRE ATT&CK: T1199 - Trusted Relationship. - Installation: The compromised
TWCoreapp is instructed to download and install a malicious application package (.apk) named JarService. This installation occurs silently in the background without user consent, leveraging the high privileges of the system app. - Execution & Persistence: JarService runs as a background service with no graphical user interface. It acts as a downloader for further malicious modules. This is a form of MITRE ATT&CK: T1219 - Remote Access Software.
- Payload: One of the downloaded modules configures the infected head unit as a reverse proxy. This allows the MoYu Group to use the car's internet connection as an exit node for their own traffic, effectively hiding their true location and using the victim's IP address for potentially malicious activities.
The vendor, DoFun, has reportedly fixed the security issues after being notified.
Impact Assessment
While the immediate impact on the driver may seem minimal (potential for slower infotainment system performance or increased data usage), the broader implications are significant. The infected vehicles become part of a malicious infrastructure, a proxy botnet. This botnet can be used to launch other cyberattacks, conduct click-fraud, or anonymize criminal activities, attributing them to the vehicle's owner. This poses a legal and reputational risk to the vehicle owners and a significant security challenge for the automotive industry. It demonstrates that even non-critical vehicle systems like infotainment can be weaponized.
IOCs — Directly from Articles
No specific file hashes, C2 domains, or IP addresses were provided in the source articles.
Cyber Observables — Hunting Hints
For owners of similar devices or security teams, the following patterns could indicate an infection:
com.car.jar.serviceJarService.apkDetection & Response
- Network Monitoring: On networks where these vehicles connect (e.g., home Wi-Fi), monitor the head unit's traffic for unusual patterns, high bandwidth consumption, or connections to known malicious IPs or regions. This applies D3FEND: Network Traffic Analysis.
- Application Inventory: On the device itself, users can check the list of installed applications for any unfamiliar apps, particularly those without icons like JarService.
- Mobile Threat Defense (MTD): For Android-based systems, MTD solutions can help detect malicious applications and anomalous behavior.
Mitigation
- Vendor Responsibility: The primary mitigation lies with the manufacturer (DoFun) to secure their software supply chain and update mechanisms, which they have reportedly done. This includes code signing and server-side validation for all updates (D3FEND: Service Binary Verification).
- User Caution: Users of aftermarket Android head units should be cautious about the source of their devices and the permissions granted to applications.
- Network Segmentation: Isolate IoT devices like car head units on a separate network segment (e.g., a guest Wi-Fi network) to prevent them from accessing other sensitive devices on the primary network.
Timeline of Events
MITRE ATT&CK Mitigations
Code Signing
Manufacturers must enforce strict code signing on all application packages and updates, ensuring that only verified, authentic software can be installed.
Mapped D3FEND Techniques:
The Android OS should enforce strict sandboxing to limit the permissions of system apps like TWCore, preventing them from installing other applications without explicit user consent.
Mapped D3FEND Techniques:
Filter Network Traffic
Users can place IoT devices like car head units on a segmented guest network to prevent a compromise from affecting other devices.
Mapped D3FEND Techniques:
D3FEND Defensive Countermeasures
The core of this attack was abusing a trusted update mechanism. The manufacturer, DoFun, must implement robust service binary verification for its TWCore application. This means that before any update or application package is downloaded and installed, the TWCore service must cryptographically verify the signature of the package against a trusted public key belonging to DoFun. The update server itself should also be secured to prevent attackers from pushing malicious, but correctly signed, packages. This ensures that only authentic, untampered software from the vendor can be installed, directly breaking the attacker's primary infection vector.
For owners and fleet managers, network traffic analysis is the most effective detection method. An infected head unit, when connected to Wi-Fi, will act as a proxy and generate continuous outbound traffic. By baselining normal network behavior for these devices, security teams can create alerts for anomalies. Specifically, monitor for: 1) High, sustained data usage when the device should be idle. 2) Connections to a large number of different destination IPs and ports, characteristic of proxy activity. 3) Traffic to known malicious or suspicious domains. This analysis can be performed on firewall logs, NetFlow data, or via an NIDS.
Timeline of Events
Kaspersky publishes a report detailing the malware campaign targeting Android head units.
Sources & References
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.