Reddit NetSec

AlienVault OTX General

CVE Database V5

Exploit-DB RSS Feed

Reddit InfoSec News

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

HUMAN's Satori team uncovered and partially disrupted BADBOX 2.0, a complex fraud operation targeting over 1 million low-cost consumer devices worldwide. The scheme involves a backdoor pre-installed on devices or distributed through unofficial app marketplaces, allowing threat actors to conduct various fraudulent activities. These include selling residential proxy services, ad fraud through hidden ads and WebViews, and click fraud. Four main threat actor groups were identified: SalesTracker, MoYu, Lemon, and LongTV. The operation affects Android Open Source Project devices in 222 countries, with Brazil being the most impacted. Disruption efforts involved collaboration with Google and other partners to mitigate the threat's impact.

BADBOX 2.0 is a sophisticated fraud campaign uncovered by HUMAN's Satori team that targets over one million low-cost consumer devices globally, primarily those running on the Android Open Source Project (AOSP). The threat actors behind BADBOX 2.0 leverage a backdoor that is either pre-installed on devices during manufacturing or distributed through unofficial app marketplaces. This backdoor enables multiple fraudulent activities, including the sale of residential proxy services, ad fraud via hidden advertisements and WebViews, and click fraud. The operation is orchestrated by at least four distinct threat actor groups named SalesTracker, MoYu, Lemon, and LongTV. The campaign's reach is extensive, affecting devices in 222 countries, with Brazil identified as the most impacted region. The backdoor facilitates covert control and communication with command and control servers, enabling the execution of various tactics such as proxy service abuse (T1071.001), ad fraud (T1608, T1608.001), and botnet activities (T1104). The disruption efforts involved collaboration between HUMAN, Google, and other partners to mitigate the threat's impact, including domain takedowns and blocking malicious infrastructure. Despite the disruption, the campaign highlights the risks associated with low-cost consumer devices that may lack robust supply chain security and the dangers of unofficial app marketplaces. BADBOX 2.0 exemplifies how compromised consumer devices can be weaponized for large-scale fraud operations, leveraging the scale and diversity of IoT and Android ecosystems.

Detailed information about Threat Intelligence Disruption: BADBOX 2.0 Targets Consumer Devices with Multiple Fraud Schemes. Get real-time updates, technical det

Threat Intelligence Disruption: BADBOX 2.0 Targets Consumer Devices with Multiple Fraud Schemes - Live Threat Intelligence - Threat Radar | OffSeq.com

Threat Intelligence Disruption: BADBOX 2.0 Targets Consumer Devices with Multiple Fraud Schemes

Between February and May, multiple exploitations of CVE-2025-32432, a Remote Code Execution vulnerability in Craft CMS, were observed. The attack chain involves deploying a webshell, downloading an infection script, and executing malicious payloads including a loader, crypto miner, and residential proxyware. The Mimo intrusion set is believed responsible, using distinctive identifiers like '4l4md4r' and 'n1tr0'. The group deploys XMRig for cryptomining and IPRoyal for bandwidth monetization. Two potential operators, 'EtxArny' and 'N1tr0', were identified through social media analysis. While showing interest in Middle Eastern affairs, the group's primary motivation appears financial. Detection opportunities include monitoring for unusual processes in temporary directories and kernel module alterations.

The threat involves a campaign by the Mimo intrusion set exploiting a Remote Code Execution (RCE) vulnerability identified as CVE-2024-46483 in Craft CMS, a popular content management system. Between February and May 2025, attackers leveraged this vulnerability to deploy webshells on compromised servers, enabling remote control and further malicious activities. The attack chain typically begins with exploitation of the RCE flaw to upload and execute a webshell, followed by downloading an infection script that installs multiple payloads. These payloads include a loader component, the XMRig cryptominer, and residential proxyware (IPRoyal) used for bandwidth monetization. The campaign is financially motivated, with the adversary using compromised systems to mine cryptocurrency and resell network bandwidth. Distinctive identifiers such as '4l4md4r' and 'n1tr0' have been linked to the group, and social media analysis suggests two potential operators named 'EtxArny' and 'N1tr0'. The group shows some interest in Middle Eastern geopolitical affairs but primarily focuses on financial gain. Detection opportunities include monitoring for unusual processes running from temporary directories, kernel module modifications, and network traffic consistent with proxyware or cryptomining activity. The campaign employs multiple MITRE ATT&CK techniques such as T1190 (Exploit Public-Facing Application), T1059.004 (Command and Scripting Interpreter: Unix Shell), T1505.003 (Server Software Component: Web Shell), T1588.006 (Obtain Capabilities: Compromise Software Supply Chain), and others related to persistence, defense evasion, and resource hijacking. Although no known exploits in the wild were reported at the time of publication, the active exploitation window and presence of webshells indicate a real and ongoing threat to Craft CMS users.

Detailed information about The Sharp Taste of Mimo'lette: Analyzing Mimo's Latest Campaign targeting Craft CMS. Get real-time updates, technical details, and mi

Title	Severity	Type	Source	Date

Threats Tagged 'residential proxy'

Filter Threats

Threats Tagged 'residential proxy'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility