Loading threat actor…
BADBOX, including the later BADBOX 2.0 cluster, is an Android/IoT botnet and malware ecosystem affecting primarily Android TV devices, smart TVs, streaming boxes, set-top boxes, and other uncertified off-brand IoT devices. The content states the original BADBOX was identified in 2023 and primarily involved Android devices compromised with backdoor malware prior to purchase, indicating supply-chain preinstallation. BADBOX 2.0 was discovered after disruption of the original campaign in 2024. The activity is described as compromising devices either before purchase or via backdoored or trojanized applications during setup. Multiple sources in the content state that BADBOX 2.0 has compromised millions of devices globally, with Google saying more than 10 million uncertified devices were affected. The ecosystem has been linked to proxy monetization: infected devices are used as residential proxy exit nodes, and Google reporting cited in the content says botnets such as BADBOX 2.0 package proxy plugins. The content also states that IPIDEA SDKs played a key role in adding devices to the BADBOX 2.0 botnet, and that components of BADBOX 2.0 overlap with Popa/NetNut. The botnet is associated with hijacked Android TV devices and has been used to support fraud and other criminal activity through residential IP proxying. The content also notes HTML5-based cashout infrastructure as a pattern previously observed in BADBOX 2.0, alongside SlopAds and Low5. One source in the content describes BADBOX 2.0 as a rival Chinese-nexus family. The broader Android TV botnet ecosystem discussed in the content places BADBOX among large criminal botnets competing for vulnerable Android TV devices. Known aliases in the provided content are badbox and badbox_20.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
4 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named botnet associated with packaging proxy plugins that help power the NetNut residential proxy ecosystem.
A botnet of hijacked Android TV devices mentioned as overlapping in components with Popa/NetNut.
A large-scale botnet materially connected to NetNut through plugin components tied to the proxy network.
Prior threat cluster associated with HTML5-based cashout sites in ad fraud and malvertising activity.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.