Loading threat actor…
BadBox 2.0 Enterprise is the name used for a large cybercriminal ecosystem centered on compromised Android-based streaming and IoT devices, including unsanctioned Android TV boxes. The operation has been described as a botnet exceeding ten million devices and is associated primarily with advertising fraud, while also enabling residential proxy abuse that can support broader criminal activity such as account takeover operations. Devices linked to this ecosystem may be compromised before sale or infected during setup through required downloads from unofficial application marketplaces rather than trusted vendor ecosystems. The actor’s tradecraft relies on supply-chain-style initial access through consumer hardware and malicious or unauthorized applications. Once devices are enrolled, the infrastructure supports persistent control of endpoints and post-compromise use as part of a botnet and proxy network. Reported behaviors associated with devices tied to this ecosystem include use of unofficial app stores, backdoored applications, remote access tooling, network manipulation, and traffic relaying through residential connections. Public reporting has also linked the ecosystem to ad fraud operations and to residential proxy services used to mask malicious traffic. BadBox 2.0 Enterprise appears to operate as a coordinated criminal enterprise rather than a nation-state intrusion set. It has been associated with Android streaming devices marketed through mainstream retail and marketplace channels, with infections facilitated by sideloaded or required third-party apps outside official distribution channels. The operation is part of the broader BADBOX activity cluster that followed disruption of the original BADBOX campaign identified in 2023 and disrupted in 2024.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
1 distinct technique observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Botnet/ecosystem involving pre-compromised unsanctioned Android streaming devices and malicious app distribution via unofficial marketplaces; primarily used for advertising fraud and also associated with broader fraud/abuse (e.g., account takeovers, scraping) per investigations referenced.
BadBox 2.0 Enterprise is a botnet operation leveraging compromised Android streaming devices to conduct advertising fraud and facilitate residential proxy services used for further cybercrime, including account takeovers and credential stuffing.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.