Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Hen Box: Inside the Coop

Summary: Unit 42 documented HenBox, an Android malware family found only on third-party app stores that masquerades as VPN and system apps and drops legitimate apps such as DroidVPN as decoys, primarily targeting Uyghurs in Xinjiang. HenBox registers the intent com.xiaomi.smarthome.receive_alarm so that alerts from Xiaomi smart-home IoT devices can trigger its code, after which it steals personal and device information from chat, communication and social media apps.

What you should know: The attackers behind HenBox have used PlugX, Zupdax, 9002 and Poison Ivy in activity dating to at least 2015, and they have turned ordinary smart-home alerts into an execution trigger - a reminder that the IoT devices on a network can serve as a remote start button for malware.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related