CYBERTVLAB
← All articles

Analysis · By CYBERTVLAB ·

The TV-box botnet problem: from BadBox to Kimwolf

For three years, one of the most reliable malware delivery vehicles in consumer tech has been the cheap TV box. The campaigns keep changing. The market conditions they exploit do not.

A pattern that keeps repeating

The campaigns below are not one continuous malware family. They are separate operations — different crews, different code, sometimes overlapping infrastructure — that keep exploiting the same conditions: low-cost Android hardware, opaque firmware supply chains, weak or absent update paths, and devices that stay online, unwatched, for years.

The technical roots do run deep on one branch of the story. Kaspersky researchers first documented the Triada Trojan in 2016 and called it one of the most advanced mobile Trojans of its time. Triada-based backdoors are what gave the BadBox line its staying power; other campaigns took different paths to the same devices. Kaspersky, which has investigated several of these families, says it has confirmed links between Triada, Vo1d, and BADBOX — shared C2 infrastructure, and a 2022 attack in which WhatsApp mods carried both Triada and BADBOX, which the researchers describe as “a joint attack by the BADBOX and Triada operators” — while cautioning that such connections are not necessarily transitive.

The consumer chapters came fast. In 2023, HUMAN Security’s Satori team disclosed BadBox: roughly 74,000 devices carrying a backdoor researchers described as Triada-based. In September 2024, Doctor Web reported Vo1d — a different backdoor entirely — across nearly 1.3 million Android TV boxes in 197 countries, planted in the system partition, with the infection vector never established.

Then came BadBox 2.0. Disclosed in March 2025 by HUMAN Security together with Google, Trend Micro, and the Shadowserver Foundation, it infected roughly a million devices at the time of disclosure — mostly off-brand, uncertified hardware: TV boxes, tablets, projectors, and aftermarket car infotainment units. Its core backdoor, BB2DOOR, is described as Triada-based, and it reached devices three different ways: a preinstalled component, code fetched from a remote server on first boot, and more than 200 trojanized versions of popular apps distributed through third-party stores. Models named in the research include X96mini, MXQ9PRO, KM9PRO, and TV98 — four entries from a 56-model list in the report’s appendix. Those names will look familiar to anyone who has browsed a marketplace for a “smart TV box.”

Traffic was observed from 222 countries, and Shadowserver’s sinkholing showed roughly half a million devices still phoning home. Google says it updated Play Protect to block apps exhibiting BadBox behavior, and in July 2025 it sued the operation’s operators in New York federal court — describing over ten million uncertified devices compromised over the campaign’s life. That figure and HUMAN’s are both true, and they measure different things: just over a million devices seen at disclosure, in March 2025; over ten million claimed five months later, across the whole operation. Neither is a precise census.

A model name in a research indicator list does not prove that every unit sold under that name is affected — hardware revisions, firmware builds, and supply-chain batches differ. Verify the exact build before drawing conclusions about a device you own.

And the pattern did not stop. In December 2025, QiAnXin’s XLab reported Kimwolf, a DDoS botnet of roughly 1.8 million Android devices — TVs, set-top boxes, tablets — with SuperBox- and X96Q-branded hardware in its victim list, and attributed it, with high confidence, to the Aisuru group — citing, among other evidence, a shared signing certificate and reused infrastructure. In February 2026, Kaspersky’s Keenadu study showed the same supply-chain playbook one layer deeper: a backdoor embedded in the firmware of new devices — tablets, in every case the researchers analyzed — including a system face-unlock app that Kaspersky described as the first Trojan it had encountered inside a facial-recognition service. In May 2026, Kaspersky summarized findings on several SuperBox units examined in late 2025: firmware that on power-up contacted servers belonging to the messaging app Tencent QQ and the proxy service “Grass” — effectively renting out the owner’s internet connection — and that shipped with a network scanner, a traffic analyzer, and DNS hijacking tools it stood ready to use. As of April 2026, those boxes were still openly sold on major platforms.

That last distinction matters, and it applies across the whole timeline: researchers observed the proxy connections; the scanning and DDoS capabilities were assessed from the code. “Capable of” and “observed doing” are different claims — and both are worth taking seriously.

Why TV boxes

None of this is an accident. A TV box is an almost ideal host for this kind of malware:

  • The economics reward shortcuts. Making a certified device — compatibility testing, licensed Google apps, an update pipeline — costs money. Cutting those costs is exactly how a box lands at an aggressive price point. The infection often happens somewhere in the supply chain, and the brand on the box may itself have no idea.
  • Always on, rarely watched. These devices stay connected and in service for years, long past the point where anyone patches them — and few people ever audit what a streaming box is doing.
  • They live on the home network. A box in the living room shares Wi-Fi with phones, laptops, NAS drives, cameras, and smart locks. Malware there is not isolated there.

What the malware is actually after

The fraud is more mundane — and more profitable — than a dramatic takeover. The documented monetization includes programmatic ad fraud (hidden ads and hidden web views), click fraud, fake account creation, and one of the fastest-growing categories: residential proxies. That last one means a stranger can rent your internet connection and appear online as you. From the outside, traffic from your IP address can end up tied to fraud, spam, and abuse — and the visible consequences (blocked sign-ups, endless CAPTCHAs, services treating your connection as hostile) land on your household, not on the operator.

The downstream risks documented across these campaigns include account takeover, OTP interception, home-network scanning, and DNS manipulation that can silently redirect where devices connect.

What actually helps

  • Prefer certified devices. Play Protect certification is the single clearest dividing line — we explain how to check yours in our two-minute guide.
  • Never disable the platform’s protection — Play Protect on certified Android TV and Google TV devices, or the built-in controls on other platforms — and treat “disable X to finish setup” instructions as a red flag.
  • Segment your network. Put TVs, cameras, speakers, and robot vacuums on a separate Wi-Fi network from phones, computers, and NAS drives — and verify the separation actually blocks access to your local network, because a misconfigured guest network gives a false sense of security.
  • Keep firmware and the router updated, and remove any app you did not install yourself — extra stores, “boosters,” “cleaners.”

And if you suspect the box itself is compromised — preinstalled extras you never installed, unexplained traffic — uninstalling apps may not help: implants like these live in the system partition, and a factory reset may not remove them. Disconnect it from your network, stop using it for sensitive accounts, check whether the vendor publishes a clean, signed firmware, and replace the device if the chain of trust cannot be restored. An app running on top of a compromised firmware cannot be fully trusted to see or remove what is underneath.

The good news: this is a well-documented problem with a knowable set of defenses. The uncomfortable part is that the same market conditions have now produced a new operation roughly every year — and the boxes are still on the shelves.

Sources

Deltavant is an on-device anti-malware app for Android TV and Google TV, currently in review with Google Play. Learn more about Deltavant.