Reddit NetSec

CVE Database V5

AlienVault OTX General

Exploit-DB RSS Feed

Reddit InfoSec News

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

HUMAN's Satori team uncovered and partially disrupted BADBOX 2.0, a complex fraud operation targeting over 1 million low-cost consumer devices worldwide. The scheme involves a backdoor pre-installed on devices or distributed through unofficial app marketplaces, allowing threat actors to conduct various fraudulent activities. These include selling residential proxy services, ad fraud through hidden ads and WebViews, and click fraud. Four main threat actor groups were identified: SalesTracker, MoYu, Lemon, and LongTV. The operation affects Android Open Source Project devices in 222 countries, with Brazil being the most impacted. Disruption efforts involved collaboration with Google and other partners to mitigate the threat's impact.

BADBOX 2.0 is a sophisticated fraud campaign uncovered by HUMAN's Satori team that targets over one million low-cost consumer devices globally, primarily those running on the Android Open Source Project (AOSP). The threat actors behind BADBOX 2.0 leverage a backdoor that is either pre-installed on devices during manufacturing or distributed through unofficial app marketplaces. This backdoor enables multiple fraudulent activities, including the sale of residential proxy services, ad fraud via hidden advertisements and WebViews, and click fraud. The operation is orchestrated by at least four distinct threat actor groups named SalesTracker, MoYu, Lemon, and LongTV. The campaign's reach is extensive, affecting devices in 222 countries, with Brazil identified as the most impacted region. The backdoor facilitates covert control and communication with command and control servers, enabling the execution of various tactics such as proxy service abuse (T1071.001), ad fraud (T1608, T1608.001), and botnet activities (T1104). The disruption efforts involved collaboration between HUMAN, Google, and other partners to mitigate the threat's impact, including domain takedowns and blocking malicious infrastructure. Despite the disruption, the campaign highlights the risks associated with low-cost consumer devices that may lack robust supply chain security and the dangers of unofficial app marketplaces. BADBOX 2.0 exemplifies how compromised consumer devices can be weaponized for large-scale fraud operations, leveraging the scale and diversity of IoT and Android ecosystems.

Detailed information about Threat Intelligence Disruption: BADBOX 2.0 Targets Consumer Devices with Multiple Fraud Schemes. Get real-time updates, technical det

Title	Severity	Type	Source	Date

Threats Tagged 'consumer devices'

Filter Threats

Threats Tagged 'consumer devices'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility