Kaspersky researchers uncovered a supply chain attack infecting Android-based car head units with malware designed for ad fraud and proxy botnet activity.
The malware was distributed through the built-in updater of TWCore, a legitimate system application installed on head units from Chinese automotive technology provider DoFun. Researchers said this is the first documented malware infection chain specifically designed to target automotive head units.
The attack uses a three-stage infection chain, beginning when the legitimate updater downloads a malicious APK. Once installed, additional malware components are retrieved that can generate fraudulent advertising activity and turn the vehicle’s internet connection into a proxy for other traffic.
The threat is imminent. Today’s notice of the critical Keycloak Password Reset Flaw (CVE-2026-18963, CVSS 9.1) exposes thousands of enterprise identity servers to risk of complete, unauthenticated takeover.
Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity, Suzu Labs:
“MoYu Group, the same actor behind BADBOX infections on cheap Android TV set-top boxes, expanded to car dashboards because to a residential proxy operator, any Android device with a Subscriber Identity Module (SIM) card is just inventory.
“DoFun’s TWCore updater accepts instructions from a Message Queuing Telemetry Transport (MQTT) broker and includes a flag called installNotExists that lets the server push entirely new applications to the device without human approval. The attackers pushed malware through this privileged deployment channel exactly as it was designed to work.
“The zhima proxy module on these head units ties back to residential proxy services PXYEDGE and ProxyForU, both connected to MoYu Group’s broader infrastructure. Compromised vehicles are being sold as proxy endpoints to whoever pays. A car sitting in a parking lot becomes someone else’s exit node, routing traffic through a cellular connection the vehicle owner pays for.
“Every original equipment manufacturer (OEM) sourcing Android-based head units from third-party firmware providers should be asking who audited the update channel before it shipped. Arbitrary code delivery already works through loadlib2, while loadlib and loadlib3 command paths were not fully implemented at the time of analysis. The proxy botnet is the current monetization model; the underlying access gives the operator considerably more capability than proxying traffic.”
John Strand, Owner, Black Hills Information Security, Inc.:
“If I’m looking at the overall trend of attacks we’ve been seeing lately, this fits right in. Supply chain attacks, malicious NPM packages, and similar techniques are increasingly showing up in some of the more advanced and interesting attacks. I’m not necessarily talking about ransomware here. I’m talking about attackers deliberately targeting areas that create blind spots for information security teams.
“For years, so much of information security has been focused on endpoints and EDR. More recently, organizations have started expanding that focus into cloud and identity security. That’s good, but attackers are moving into technologies that many traditional security stacks simply weren’t designed to monitor.
“Supply chain attacks are a perfect example. So is Android malware targeting head units used by automobile manufacturers. Most people aren’t running EDR on their car.
That sounds funny, but it highlights a serious problem.
“Attackers are finding technologies that fall outside the visibility of traditional security tools. Once they get into those environments, they have an opportunity to propagate, establish persistence, and potentially remain undetected for long periods of time. The problem isn’t necessarily that security teams aren’t paying attention. In many cases, the technology they’ve invested in simply doesn’t support these systems.”
The CISA orders federal agencies to patch actively exploited Oracle flaw by August 27
Posted in Commentary with tags CISA on August 25, 2026 by itnerdThe CISA has added a maximum-severity Oracle vulnerability, CVE-2026-21962, to its Known Exploited Vulnerabilities catalog after confirming active exploitation.
The flaw carries a CVSS score of 10.0 and affects Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in for Apache HTTP Server and IIS.
The vulnerability can be exploited remotely over HTTP without authentication or valid credentials, potentially allowing attackers to access, modify or delete critical data.
Oracle originally disclosed and patched CVE-2026-21962 on January 20, 2026, as part of its January Critical Patch Update. In March, researchers reported exploitation attempts after exploit code became publicly available.
CISA has ordered federal agencies to address the vulnerability by August 27.
Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity, Suzu Labs Had This To Say:
“CVE-2026-21962 had a patch on January 20, and CloudSEK recorded exploitation attempts against its honeypot on January 22, followed by broader automated scanning. CISA added it to the KEV catalog on August 24, 216 days after the patch. Federal agencies now have three days to remediate something attackers have had seven months to exploit.
“In January, agencies could have applied the Critical Patch Update inside a normal maintenance window and moved on. Seven months of delay while exploitation attempts and automated scanning were already being observed from rented VPS infrastructure changed the math. BOD 26-04 requires forensic triage at this severity tier, so agencies now have to assess whether compromise occurred during that seven-month exposure period alongside applying the patch.
“BOD 26-04’s 16-tier remediation matrix is well-designed for the problem it solves. For a vulnerability in the KEV, automatable, and yielding total control of a public-facing asset, the clock is three days with forensic triage. In this case, CISA’s August 24 KEV addition produced an August 27 federal remediation deadline, while CISA’s obligation is to update the catalog “as quickly as possible,” with no numerical SLA. EPSS ranked this in the top 1.4%, Shodan shows roughly 79,000 exposed Oracle HTTP Server instances, and CISA’s own SSVC record dates active exploitation to January 21 while classifying the vulnerability as automatable with total technical impact.
“Three days to remediate is the right call. Seven months to trigger it turned a maintenance window into a forensic investigation.”
This of course means update all the things ASAP. But we’re getting to a point where patching anything is a losing battle. Thus we need to think of something new when this avenue exhausts itself.
UPDATE: Also Commenting on this is Dan Moore, Sr. Director, CIAM Strategy & Identity Standards at FusionAuth:
“The thousands of organizations relying on Oracle WebLogic to provide secure access to their applications are at risk of data loss, manipulation, and exfiltration. The unauthenticated access allows an attacker to make application calls to read data, as well as insert their own unauthorized changes. This issue affects any server accessible to an attacker, which is extremely problematic for many internet exposed applications.”
Leave a comment »