Operation Fuyao: Android TV Boxes Hijacking Residential Bandwidth — Detection and Containment

A new supply-chain threat named Operation Fuyao has emerged, turning inexpensive Android TV boxes into covert residential proxy nodes and ad-fraud bots. According to research by Bitsight, threat actors associated with Zhejiang Fengwo IoT Technology Co., Ltd. (a mainland China company) have shipped devices pre-loaded with malicious firmware or applications.

These devices are not merely compromised; they are engineered to deceive. The malware rewrites the device's hardware identity to mimic legitimate smartphones from major manufacturers like Samsung, Huawei, Xiaomi, and Vivo. This spoofing allows the devices to bypass ad-fraud detection mechanisms while clicking ads to generate revenue for the operators. More critically for defenders, the second payload turns the victim's broadband connection into a proxy node, likely rented out to cybercriminals for anonymity.

For security practitioners, this represents a significant risk within the "Shadow IoT" landscape. These devices often bypass standard enterprise asset inventories, operating in a blind spot while consuming bandwidth and exposing the organization to legal liability if the IP address is implicated in malicious activity.

Technical Analysis

Affected Products: Generic, low-cost Android TV boxes. The specific branding varies, but the campaign targets the Android TV ecosystem running on modified firmware.

Threat Actor: Zhejiang Fengwo IoT Technology Co., Ltd., attributed to the Operation Fuyao campaign.

Attack Chain and Mechanism:

1. Supply Chain Compromise: Malicious apps or modified firmware are pre-installed on the devices at the manufacturing or distribution level.
2. Identity Spoofing: Upon activation, the malware modifies system properties (likely build.prop on Android) to masquerade as a high-end mobile device (e.g., Samsung Galaxy). This ensures the device receives mobile-specific ads and evades botnet filters designed to block datacenter or TV-based traffic.
3. Ad Fraud: Background processes simulate user interaction, clicking ads on websites controlled by the threat actors.
4. Proxy Service: The device listens on inbound ports, accepting traffic from the internet and tunneling it through the victim's residential broadband connection. This effectively turns the device into a node in a residential proxy network.

Exploitation Status: Active exploitation confirmed. The devices are shipping with the malware, meaning the "vulnerability" is the hardware itself, rendering traditional patching ineffective without firmware replacement or device destruction.

Detection & Response

Detecting Operation Fuyao requires a shift from endpoint-specific monitoring to network behavioral analysis and hardware identity verification. Defenders should look for discrepancies between the reported device type and its actual network behavior, as well as unauthorized server processes running on IoT segments.

Sigma Rules

---
title: Operation Fuyao - Android TV Proxy Process
id: a1b2c3d4-5678-90ab-cdef-1234567890ab
status: experimental
description: Detects common proxy server binaries running on Android/Linux TV devices which may indicate participation in a residential proxy botnet like Operation Fuyao.
references:
 - https://thehackernews.com/2026/07/cheap-android-tv-boxes-pose-as-phones.html
author: Security Arsenal
date: 2026/07/22
tags:
 - attack.command_and_control
 - attack.t1071.001
logsource:
 category: process_creation
 product: linux
detection:
 selection:
 Image|endswith:
 - '/tinyproxy'
 - '/3proxy'
 - '/squid'
 - '/privoxy'
 - '/shadowsocks'
   # Common binaries used on Android for proxying
   - '/libproxy'
 condition: selection
falsepositives:
 - Legitimate router or gateway devices configured as proxies
level: high
---
title: Operation Fuyao - Mobile User-Agent from Non-Mobile Device
id: b2c3d4e5-6789-01ab-cdef-2345678901bc
status: experimental
description: Detects HTTP requests indicating a mobile device (Samsung/Huawei) originating from a source MAC address OUI associated with TV/Set-top box vendors or IoT segments.
references:
 - https://thehackernews.com/2026/07/cheap-android-tv-boxes-pose-as-phones.html
author: Security Arsenal
date: 2026/07/22
tags:
 - attack.initial_access
 - attack.t1190
logsource:
 category: proxy
 product: zeek
detection:
 selection_ua:
 http.user_agent|contains:
 - 'SAMSUNG'
 - 'Build/Huawei'
 - 'Xiaomi'
 - 'Vivo'
 selection_mac:
 - http.mac|startswith: '00:04:25' # Example TV vendor OUI (fictional placeholder for logic)
 - http.mac|startswith: 'F0:2F:4B' # Example TV vendor OUI
 condition: all of selection_*
falsepositives:
 - Users bridging mobile hotspot connections
 - Mixed VLANs
level: medium

KQL (Microsoft Sentinel)

// Hunt for high volume of outbound connections from IoT segments characteristic of proxy activity
// Adjust DeviceCategory based on your endpoint classification
let IoTDevices = DeviceNetworkEvents
| where DeviceCategory in ("Audio-Video", "TV", "IoT", "Entertainment")
| summarize arg_min(Timestamp, *) by DeviceId;
DeviceNetworkEvents
| where DeviceId in (IoTDevices)
| where RemotePort in (80, 443, 8080, 1080, 3128) or RemotePort >= 10000
| summarize Count = dcount(RemoteIP), TotalConnections = count() by DeviceId, bin(Timestamp, 1h)
| where Count > 50 // Threshold for high number of distinct remote IPs
| project Timestamp, DeviceId, Count, TotalConnections
| order by TotalConnections desc

Velociraptor VQL

-- Hunt for suspicious network listeners and proxy binaries on Linux/Android endpoints
SELECT ListenAddress, Port, PID, ProcessName, Exe
FROM listen_sockets()
WHERE Port IN (8080, 1080, 3128, 8888, 9999)
  AND Exe NOT IN ('/usr/bin/nginx', '/usr/sbin/apache2')

-- Check for modification of system properties indicative of device spoofing
SELECT FullPath, Mtime, Size, Mode
FROM glob(globs='/system/build.prop', '/vendor/build.prop')
WHERE Mtime > timestamp("2026-01-01")

Remediation Script (Bash)

#!/bin/bash
# Remediation script for Operation Fuyao indicators on Linux/Android boxes
# Requires root privileges

echo "[*] Checking for common proxy binaries..."
PROXY_BINARIES=('tinyproxy' '3proxy' 'squid' 'privoxy' 'shadowsocks' 'v2ray')
FOUND_BINS=()

for bin in "${PROXY_BINARIES[@]}"; do
  if pgrep -x "$bin" > /dev/null; then
    echo "[!] Running proxy process detected: $bin"
    FOUND_BINS+=("$bin")
  fi
done

echo "[*] Checking for non-standard listening ports (8080, 1080, 3128)..."
netstat -tuln | grep -E ':(8080|1080|3128|8888)'

echo "[*] Verifying build.prop integrity (checking for model mismatches)..."
if [ -f /system/build.prop ]; then
  echo "Current Product Model:"
  grep "ro.product.model" /system/build.prop
fi

echo "[*] Remediation Actions:" 
echo "1. Isolate the device from the network immediately."
echo "2. If proxy processes were found, perform a factory reset."
echo "3. If the behavior persists post-reset, destroy the device (supply chain compromise)."

Remediation

Remediating supply-chain compromised IoT devices is notoriously difficult because the malware resides in the firmware or system partitions that are not easily overwritten by the user.

1. Immediate Isolation: Identify the MAC address of the affected Android TV box and block it at the switch or firewall level. Place it in a captive VLAN with no internet access.

2. Factory Reset (Limited Efficacy): Attempt a factory reset of the device. However, be aware that Operation Fuyao payloads may reside in the protected system partition. If the malware reappears after a reset, the device firmware is permanently compromised.

3. Device Destruction/Replacement: The only guaranteed remediation for a firmware-level supply chain attack is physical disposal of the device. Replace it with reputable brands that adhere to security best practices and signed firmware updates.

4. Network Segmentation: Ensure all IoT and "Smart TV" devices are on a separate VLAN (Guest/IoT) that cannot communicate with internal management servers or traverse the corporate network freely.

5. Proxy Blocking: Configure perimeter firewalls to block outbound traffic from IoT subnets on common proxy ports (TCP 1080, 3128, 8080) unless explicitly required.

Related Resources

Security Arsenal Red Team Services AlertMonitor Platform Book a SOC Assessment pen-testing Intel Hub