{
  "name": "Long Live The Vo1d Botnet: New Variant Hits 1.6 Million TV Globally",
  "slug": "long-live-the-vo1d-botnet-new-variant-hits-16-million-tv-globally",
  "description": "The Vo1d botnet has infected 1.6 million Android TV devices across 200+ countries, posing a significant cybersecurity threat. This new variant demonstrates enhanced stealth and resilience, utilizing RSA encryption, DGA-based infrastructure, and a modified XXTEA algorithm. The botnet's scale and capabilities surpass previous major attacks, potentially enabling devastating DDoS attacks or unauthorized content broadcasting. Analysis reveals a sophisticated multi-component system including downloaders, backdoors, and modular malware for proxy services and ad fraud. The botnet's rapid growth and evasion techniques highlight the urgent need for improved security measures in smart TV devices and set-top boxes.",
  "published": "2025-02-28T09:35:45+00:00",
  "created_at": "2025-02-28T09:35:45+00:00",
  "modified_at": "2025-02-28T10:10:59+00:00",
  "created_at_opencti": "2025-02-28T09:35:45+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2025-02-28",
    "android tv",
    "botnet",
    "proxy network",
    "set-top box",
    "vo1d"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "69.28.62.61"
      },
      {
        "id": "",
        "name": "69.28.62.60"
      },
      {
        "id": "",
        "name": "69.28.62.52"
      },
      {
        "id": "",
        "name": "69.28.62.51"
      },
      {
        "id": "",
        "name": "69.28.62.50"
      },
      {
        "id": "",
        "name": "69.28.62.49"
      },
      {
        "id": "",
        "name": "69.28.62.48"
      },
      {
        "id": "",
        "name": "69.28.62.41"
      },
      {
        "id": "",
        "name": "69.28.62.42"
      },
      {
        "id": "",
        "name": "69.28.62.39"
      },
      {
        "id": "",
        "name": "69.28.62.38"
      },
      {
        "id": "",
        "name": "38.61.8.33"
      },
      {
        "id": "",
        "name": "38.61.8.31"
      },
      {
        "id": "",
        "name": "38.61.8.14"
      },
      {
        "id": "",
        "name": "38.61.8.13"
      },
      {
        "id": "",
        "name": "38.61.8.12"
      },
      {
        "id": "",
        "name": "38.61.8.11"
      },
      {
        "id": "",
        "name": "38.46.218.39"
      },
      {
        "id": "",
        "name": "38.46.218.38"
      },
      {
        "id": "",
        "name": "38.46.218.36"
      },
      {
        "id": "",
        "name": "38.46.218.37"
      },
      {
        "id": "",
        "name": "156.236.118.48"
      },
      {
        "id": "",
        "name": "156.236.118.27"
      },
      {
        "id": "",
        "name": "128.1.71.243"
      },
      {
        "id": "",
        "name": "https://dcsdkos.dc16888888.com/sdkbin"
      },
      {
        "id": "",
        "name": "https://dcsdkos.dc16888888.com/reportcompbin"
      },
      {
        "id": "",
        "name": "https://dcsdk.100ulife.com/sdkbin"
      },
      {
        "id": "",
        "name": "https://dcsdk.100ulife.com/reportcompbin"
      },
      {
        "id": "",
        "name": "http://task.moyu88.xyz/cpc/api/xml?productId=0"
      },
      {
        "id": "",
        "name": "http://task.moyu88.xyz/cpc/api/task"
      },
      {
        "id": "",
        "name": "http://ssl87362.com:9999"
      },
      {
        "id": "",
        "name": "http://task.moyu88.xyz/cpc/api/proxy/origin"
      },
      {
        "id": "",
        "name": "http://jaguar-distributor.syslogcollector.com:12000/v1/agent/ctrl"
      },
      {
        "id": "",
        "name": "http://dcsdkos.dc16888888.com/sdkbin"
      },
      {
        "id": "",
        "name": "http://dcsdk.100ulife.com/sdkbin"
      },
      {
        "id": "",
        "name": "http://dcsdkos.dc16888888.com/reportcompbin"
      },
      {
        "id": "",
        "name": "http://dcsdk.100ulife.com/reportcompbin"
      },
      {
        "id": "",
        "name": "http://csskkjw.com/s3/b7027626"
      },
      {
        "id": "",
        "name": "http://adstat.ziyemy.shop:3389"
      },
      {
        "id": "",
        "name": "update.ad3g.com"
      },
      {
        "id": "",
        "name": "wowokeys.com"
      },
      {
        "id": "",
        "name": "ssl87362.com"
      },
      {
        "id": "",
        "name": "spiritlib.cyou"
      },
      {
        "id": "",
        "name": "csskkjw.com"
      },
      {
        "id": "",
        "name": "csok997.com"
      },
      {
        "id": "",
        "name": "conannt.com"
      },
      {
        "id": "",
        "name": "catmore23.com"
      },
      {
        "id": "",
        "name": "2940637fafa.com"
      }
    ],
    "malware": [
      {
        "id": "9ab7b4d1-b937-466f-9943-c0ef02f4a924",
        "name": "Vo1d",
        "slug": "vo1d"
      },
      {
        "id": "6ab91206-97d3-4599-a19b-4ee827a58f1b",
        "name": "Mzmess",
        "slug": "mzmess"
      },
      {
        "id": "7d4f5611-97bc-499d-8b01-f6bb3337ec40",
        "name": "BigPanzi",
        "slug": "bigpanzi"
      }
    ],
    "intrusion_sets": [
      {
        "id": "6ea2f11c-bda0-4ad0-a2b2-0a664a1294fe",
        "name": "Vo1d",
        "slug": "vo1d"
      }
    ],
    "attack_patterns": [
      {
        "id": "4bbdf41c-817c-448a-9513-aaea6bfbe8b4",
        "name": "T1568"
      },
      {
        "id": "14ea0786-b57c-4a30-8e4e-46944d17eb18",
        "name": "T1036.004"
      },
      {
        "id": "9c5a20d1-0df9-4e99-bcc5-0b731a78b5d1",
        "name": "T1608"
      },
      {
        "id": "e1b18ecf-d74e-4fe6-9bd4-ca6a62e7d818",
        "name": "T1027.002"
      },
      {
        "id": "93b2c4dd-5523-4464-8976-78754ee372fd",
        "name": "T1012"
      },
      {
        "id": "a72ebeae-8e62-4039-8135-e9c611011fdc",
        "name": "T1573"
      },
      {
        "id": "dc17cbbd-40d8-43cf-b3cf-50d1276db2c7",
        "name": "T1016"
      },
      {
        "id": "2c3d4267-2bae-41ae-8486-5876953a1748",
        "name": "T1129"
      },
      {
        "id": "70616b2f-4019-4963-b758-5d9f6f20e201",
        "name": "T1082"
      },
      {
        "id": "cbd87c8c-3bed-461a-acef-56ffc8b87571",
        "name": "T1105"
      },
      {
        "id": "dc342445-1b78-48b4-aa06-89ed2ad7c28e",
        "name": "T1071"
      },
      {
        "id": "870bd958-53a3-4d25-9f23-00aa8bd6674d",
        "name": "T1102"
      },
      {
        "id": "c3af9fd7-d307-4df4-9220-cc627938fb85",
        "name": "T1055"
      },
      {
        "id": "7d7ac733-6442-416f-8669-c302dd0843b9",
        "name": "T1036"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      },
      {
        "id": "81ee4813-4f68-4984-bec1-980d7c5b56eb",
        "name": "T1132"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "09124a92-c11f-4571-b35b-ab0bce6dd081",
        "name": "T1112"
      },
      {
        "id": "b6e505a1-fadb-491a-b4f1-151443fdc8c3",
        "name": "T1001"
      },
      {
        "id": "9b6064e6-a05b-4e95-baf5-34d180bc9221",
        "name": "T1059"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "British Indian Ocean Territory"
      },
      {
        "id": "",
        "name": "Iraq"
      },
      {
        "id": "",
        "name": "South Africa"
      },
      {
        "id": "",
        "name": "India"
      },
      {
        "id": "",
        "name": "China"
      },
      {
        "id": "",
        "name": "Argentina"
      },
      {
        "id": "",
        "name": "Thailand"
      },
      {
        "id": "",
        "name": "Malaysia"
      },
      {
        "id": "",
        "name": "Indonesia"
      },
      {
        "id": "",
        "name": "Germany"
      },
      {
        "id": "",
        "name": "Morocco"
      },
      {
        "id": "",
        "name": "Philippines"
      },
      {
        "id": "",
        "name": "Ecuador"
      },
      {
        "id": "",
        "name": "Mexico"
      },
      {
        "id": "",
        "name": "Pakistan"
      },
      {
        "id": "",
        "name": "Brazil"
      },
      {
        "id": "",
        "name": "United States of America"
      },
      {
        "id": "",
        "name": "Russian Federation"
      },
      {
        "id": "",
        "name": "Media"
      },
      {
        "id": "",
        "name": "Telecommunications"
      }
    ]
  },
  "external_refs": [
    "https://blog.xlab.qianxin.com/long-live-the-vo1d_botnet",
    "https://otx.alienvault.com/pulse/67c1918118f436e845d1d994"
  ]
}