Threat Summary
Security researchers have uncovered a massive supply chain compromise operation attributed to Videostrong Technology Co., Ltd., the manufacturer behind MECOOL Android set-top boxes. This campaign, tracked as BADBOX, has resulted in the pre-infection of over 1.3 million devices with the x.cpe backdoor before reaching end users. The compromised devices are being leveraged as a distributed residential proxy network and ad fraud platform, monetizing infected hardware through multiple illicit channels.
The attack chain begins at the firmware level, where x.cpe is embedded during the manufacturing process. Once devices are deployed in consumer and enterprise environments across the United States, Brazil, China, Germany, Malaysia, and Mexico, the backdoor establishes persistent communication via MQTT protocol infrastructure. The operators deploy a modular payload ecosystem including residential proxy SDKs (Honeygain, Traffmonetizer, Gaganode, TitanNet), ad fraud modules (AdMoyu, Appsalt, APSolo), and additional backdoors (LinkFog, Kimwolf, Nexus).
The primary objectives are bandwidth monetization through residential proxy services, advertising fraud revenue generation, and maintaining persistent access to compromised networks for potential secondary exploitation. This represents a critical supply chain risk where hardware trust has been fundamentally compromised at the source.
Threat Actor / Malware Profile
x.cpe Backdoor
The core implant is a firmware-level backdoor providing system-level access to Android TV devices. It communicates with command and control infrastructure using MQTT messaging protocol, allowing operators to push arbitrary payloads and maintain persistence across reboots.
Residential Proxy SDKs (Honeygain, Traffmonetizer, Gaganode, TitanNet)
These legitimate-appearing software development kits are abused to enroll infected devices into residential proxy networks. They tunnel traffic through consumer IP addresses, effectively laundering malicious traffic and enabling anonymized attacks from residential ASNs. The SDKs run as background services, consuming bandwidth and generating revenue for the botnet operators.
Ad Fraud Modules (AdMoyu, Appsalt, APSolo)
These modules conduct automated advertisement fraud by generating fake clicks, impressions, and engagement metrics. They simulate human interaction with advertisements while remaining invisible to the device user, siphoning advertising revenue through programmatic fraud schemes.
Additional Payloads (LinkFog, Kimwolf, Nexus)
Secondary implants provide redundancy and expanded capabilities, including potential credential harvesting, lateral movement tools, and additional proxy functionalities. Kimwolf specifically has been observed in previous Android-targeting campaigns.
Distribution Method: Supply chain compromise at the manufacturing level (Videostrong Technology Co., Ltd.) Payload Behavior: Modular payload delivery via MQTT; residential proxy enrollment; ad fraud automation C2 Communication: MQTT protocol over TCP 1883/8883; fallback HTTP/HTTPS channels; domains including api.package.coreservice.io Persistence: Firmware-level installation; survives factory resets; system partition modification Anti-Analysis: Firmware obfuscation; legitimate SDK abuse to blend with normal traffic; encrypted MQTT payloads
IOC Analysis
The pulse contains 400 indicators spanning multiple types critical for detection:
IPv4 Addresses (e.g., 219.134.163.210): C2 infrastructure and MQTT broker endpoints. Block at network perimeter and monitor for outbound connections.
Hostnames/Domains (e.g., api.package.coreservice.io, bmw.bestipip.com): C2 domains used for payload delivery and proxy enrollment. Implement DNS sinkholing and monitor for DNS resolution attempts.
FileHash-SHA256: Malicious APK files, payload modules, and modified firmware images. Deploy to EDR platforms for retroactive hunting and blocking.
SOC teams should operationalize these indicators through:
- SIEM Integration: Import IOCs into threat intelligence platforms (TIP) for correlation with network logs
- EDR Blocking: Deploy SHA256 hashes to endpoint detection platforms for execution prevention
- Network Segmentation: Block outbound MQTT (1883/8883) to suspicious destinations
- DNS Filtering: Sinkhole identified C2 domains at the DNS resolver level
Tools for decoding and analysis include Wireshark for MQTT traffic inspection, APKTool for Android application analysis, and YARA for pattern matching against firmware images.
Detection Engineering
---
title: BADBOX x.cpe MQTT C2 Communication
id: 8f4a9b2c-3d5e-4f6a-9c1d-2e7b8a9f0c1d
status: experimental
description: Detects MQTT protocol communication to known BADBOX C2 infrastructure associated with x.cpe backdoor
references:
- https://synthient.com/blog/the-internals-of-a-badbox-operation
author: Security Arsenal
date: 2026/11/04
tags:
- attack.command_and_control
- attack.t1071
logsource:
category: network_connection
product: firewall
detection:
selection_ip:
DestinationIp: 219.134.163.210
selection_domain:
DestinationHostname|contains:
- 'api.package.coreservice.io'
- 'bmw.bestipip.com'
condition: selection_ip or selection_domain
falsepositives:
- Legitimate MQTT IoT traffic (unlikely to these specific destinations)
level: high
---
title: Android Proxy SDK Execution
id: 9a5b8c3d-4e6f-5a7b-0d2e-3f8c9a0b1d2e
status: experimental
description: Detects execution of residential proxy SDKs associated with BADBOX operation on Android devices
references:
- https://synthient.com/blog/the-internals-of-a-badbox-operation
author: Security Arsenal
date: 2026/11/04
tags:
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: android
detection:
selection_img:
Image|endswith:
- '\libhoneygain.so'
- '\libtraffmonetizer.so'
- '\libgaganode.so'
- '\libtitannet.so'
selection_cmd:
CommandLine|contains:
- 'honeygain'
- 'traffmonetizer'
- 'gaganode'
- 'titannet'
condition: selection_img or selection_cmd
falsepositives:
- Legitimate user-installed proxy applications (rare in enterprise context)
level: medium
---
title: BADBOX Ad Fraud Module Installation
id: 0b6c9d4e-5f7a-6b8c-1e3f-4a9d0b2c3e4f
status: experimental
description: Detects installation of ad fraud modules associated with BADBOX supply chain compromise
references:
- https://synthient.com/blog/the-internals-of-a-badbox-operation
author: Security Arsenal
date: 2026/11/04
tags:
- attack.persistence
- attack.t1543
logsource:
category: file_event
product: android
detection:
selection_package:
TargetFilename|contains:
- 'admoyu'
- 'appsalt'
- 'apsolo'
- 'linkfog'
- 'kimwolf'
condition: selection_package
falsepositives:
- None expected for these specific package names
level: high
// BADBOX Infrastructure Hunt - Microsoft Sentinel
let badbox_ips = dynamic(["219.134.163.210"]);
let badbox_domains = dynamic(["api.package.coreservice.io", "bmw.bestipip.com"]);
union isfuzzy=true
(DeviceNetworkEvents
| where RemoteIP in~ (badbox_ips) or RemoteUrl has_any (badbox_domains)
| project TimeGenerated, DeviceName, RemoteIP, RemoteUrl, InitiatingProcessFileName, ActionType),
(DeviceProcessEvents
| where ProcessCommandLine has_any ("honeygain", "traffmonetizer", "gaganode", "titannet", "admoyu", "appsalt", "apsolo")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, SHA256),
(CommonSecurityLog
| where DestinationIP in~ (badbox_ips) or DestinationHostName has_any (badbox_domains)
| project TimeGenerated, SourceIP, DestinationIP, DestinationHostName, DeviceAction)
| sort by TimeGenerated desc
# BADBOX IOC Hunt Script for Windows/Android Management Infrastructure
$badboxHashes = @(
"5547392697063aab2f2cf7510048c4e957181bfe99d12173671fd1528b77c309",
"07b511a6f7715ccd2f77b5f51e4cf46542ccaada99564252711f4a142ac26179",
"b84ccf36e373db0f1d41121e7d3ddc57a3e12aa4637b09c16fa88e96fa1cdf6c",
"7a83708da58732571932c302038739f91a870b2f6f4e687c010ff4e7d86b0469",
"2a443baa14be4a2a45b7ea477a8ffc326169aaecc89919a42cf386d0978db0f2"
)
$badboxDomains = @("api.package.coreservice.io", "bmw.bestipip.com")
$badboxIP = "219.134.163.210"
Write-Host "=== BADBOX Supply Chain Compromise Hunt ===" -ForegroundColor Cyan
# Check network connections
Write-Host "[*] Checking for BADBOX C2 connections..." -ForegroundColor Yellow
$connections = Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object {$_.RemoteAddress -eq $badboxIP}
if ($connections) {
Write-Host "[!] ALERT: Connection to BADBOX C2 detected!" -ForegroundColor Red
$connections | Format-Table -AutoSize
}
# Check DNS cache
Write-Host "[*] Checking DNS cache for BADBOX domains..." -ForegroundColor Yellow
$dnsCache = Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object {$_.Entry -match "coreservice|bestipip"}
if ($dnsCache) {
Write-Host "[!] ALERT: BADBOX domain in DNS cache!" -ForegroundColor Red
$dnsCache | Format-Table -AutoSize
}
# Check for proxy SDK processes
Write-Host "[*] Checking for residential proxy SDKs..." -ForegroundColor Yellow
$proxyProcesses = Get-Process -ErrorAction SilentlyContinue | Where-Object {
$_.ProcessName -match "honeygain|traffmonetizer|gaganode|titannet"
}
if ($proxyProcesses) {
Write-Host "[!] ALERT: BADBOX proxy SDK running!" -ForegroundColor Red
$proxyProcesses | Format-Table -AutoSize
}
# Check Android device files if ADB available
if (Get-Command adb -ErrorAction SilentlyContinue) {
Write-Host "[*] Checking connected Android devices for BADBOX packages..." -ForegroundColor Yellow
$packages = adb shell pm list packages 2>$null | Select-String -Pattern "admoyu|appsalt|apsolo|linkfog|kimwolf"
if ($packages) {
Write-Host "[!] ALERT: BADBOX packages detected on Android device!" -ForegroundColor Red
$packages
}
}
Write-Host "[*] Hunt complete. Review any alerts above." -ForegroundColor Green
Response Priorities
Immediate
- Block C2 IP 219.134.163.210 at network perimeter
- Sinkhole domains api.package.coreservice.io and bmw.bestipip.com
- Deploy SHA256 hashes to EDR for blocking execution
- Audit network for MQTT traffic (ports 1883/8883) to unknown destinations
24h
- Inventory all Android-based devices (set-top boxes, IoT) in the environment
- Hunt for execution of Honeygain, Traffmonetizer, Gaganode, or TitanNet SDKs
- Check for unexpected outbound proxy traffic from consumer-grade devices
- Review DHCP logs for MECOOL or Videostrong-manufactured devices
1 Week
- Implement network segmentation isolating IoT/AV devices from corporate networks
- Deploy firmware verification processes for new hardware procurement
- Establish supply chain security assessments for hardware vendors
- Consider replacing Videostrong-manufactured devices with verified alternatives
Related Resources
Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.