Badbox Android botnet disrupted through coordinated threat hunting – Source: www.csoonline.com

Badbox, the notorious Android malware botnet, has been disrupted for a third time in 15 months, with over half a million infected machines now sinkholed.

A co-ordinated effort led by the bot detection and mitigation platform, Human Security, will likely cripple the suddenly inflated cybercrime operation that has compromised over one million Android devices worldwide.

“Human’s Satori Threat Intelligence and Research team recently uncovered and — in collaboration with Google, Trend Micro, Shadowserver, and other partners — partially disrupted a complex and expansive fraud operation dubbed ‘Badbox 2.0’,” Human researchers said in a blog post.

The Badbox botnet operation distributes malware through compromised consumer electronics, primarily Android-based TV boxes.

Operation grew multifold since the earlier busts

Satori researchers observed the evolution of the Badbox operation into Badbox 2.0, confirming that disruption was merely a temporary setback for the threat actors. Following the first disclosure in 2023, the C2 servers powering Badbox were shut down, and infected devices were removed from major marketplaces.

However, attackers quickly adapted, making minor tweaks to evade detection, which apparently survived a second major takedown by the German authorities in December 2024.

“The BADBOX 2.0 scheme is bigger and far worse than what we saw in 2023 in terms of the uptick in types of devices targeted, the number of devices infected, the different types of fraud conducted, and the complexity of the scheme,” Gavin Reid, CISO of Human, said in a press statement. “This operation embodies the interconnected nature of modern cyberattacks and how threat actors target the customer journey and demonstrates why businesses require full-spectrum protection from the impacts of digital fraud and abuse.”

The investigation revealed deceptive tactics used by the attackers, including a fake version of Saletracker, a module originally designed for sales monitoring by a Chinese device manufacturer. The attackers disguised their Triada-based backdoor under this fake module, using it as a cover for controlling infected devices.

Additionally, the threat actors established a series of domains to host new C2 servers. By spring of 2024, Satori researchers identified new test versions of backdoors linked to these C2 servers.

“Satori identified more than 1 million devices that were infected in Badbox 2.0, up from the 74,000 in the original Badbox scheme,“ Human added.

Badbox 2.0 operates multiple frauds

“Badbox 2.0 threat actors also operated over 200 re-bundled and infected versions of popular apps listed on third-party marketplaces and served as an alternative backdoor delivery system,“ researchers added. Of these, the team identified 24 “evil twin” apps with corresponding “decoy twin” apps on the Play Store, through which ad fraud is conducted.

Human collaborated with Google to take these apps off Google Play. “We appreciate collaborating with Human to take action against the Badbox operation and protect consumers from fraud,” Shailesh Saini, Director of Android Security & Privacy Engineering & Assurance, Google, said in a press statement.“The infected devices are Android Open Source Project devices, not Android TV OS devices or Play Protect certified Android devices.“

Users should ensure Google Play Protect, Android’s malware protection that is switched on by default on devices with Google Play Services, is enabled, Saini added. Human Security, in collaboration with the internet security group Shadowserver Foundation, sinkholed multiple Badbox 2.0 domains, disrupting communication between over 500,000 infected devices and the botnet’s C2 servers.