Who Operates the Badbox 2.0 Botnet?
Summary: A source close to the Kimwolf botmasters says they shared a screenshot showing they had gained unauthorized access to the control panel for Badbox 2.0, a China-based botnet that Google described in a July 2025 lawsuit as spanning over ten million unsanctioned Android streaming devices. KrebsOnSecurity traced the qq.com email addresses in that panel to China-based technology companies and individuals, including Chen Daihai and Zhu Zhiyu, whose domains were previously flagged in a March 2025 HUMAN Security report as tied to Badbox 2.0.
Key Takeaway: The source said normal proxy providers patched the abuse path Kimwolf used to spread, but Badbox 2.0 does not sell proxies and so was not patched - meaning as long as Dort holds that panel access, Kimwolf malware can be loaded directly onto Badbox-associated TV boxes.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026