{“lastseen”:”2026-01-26T18:05:09″,”description”:”The cybercriminals in control of **Kimwolf** — a disruptive botnet that has infected more than 2 million devices — recently shared a screenshot indicating they’d compromised the control panel for **Badbox 2.0** , a vast China-based botnet powered by malicious software that comes pre-installed on many Android TV streaming boxes. Both the FBI and Google say they are hunting for the people behind Badbox 2.0, and thanks to bragging by the Kimwolf botmasters we may now have a much clearer idea about that.\\n\\nOur first story of 2026, The Kimwolf Botnet is Stalking Your Local Network, detailed the unique and highly invasive methods Kimwolf uses to spread. The story warned that the vast majority of Kimwolf infected systems were unofficial Android TV boxes that are typically marketed as a way to watch unlimited (pirated) movie and TV streaming services for a one-time fee.\\n\\nOur January 8 story, Who Benefitted from the Aisuru and Kimwolf Botnets?, cited multiple sources saying the current administrators of Kimwolf went by the nicknames \\”**Dort** \\” and \\”**Snow**.\\” Earlier this month, a close former associate of Dort and Snow shared what they said was a screenshot the Kimwolf botmasters had taken while logged in to the Badbox 2.0 botnet control panel.\\n\\nThat screenshot, a portion of which is shown below, shows seven authorized users of the control panel, including one that doesn’t quite match the others: According to my source, the account \\”**ABCD** \\” (the one that is logged in and listed in the top right of the screenshot) belongs to Dort, who somehow figured out how to add their email address as a valid user of the Badbox 2.0 botnet.\\n\\n\\n\\nThe control panel for the Badbox 2.0 botnet lists seven authorized users and their email addresses. Click to enlarge.\\n\\nBadbox has a storied history that well predates Kimwolf’s rise in October 2025. In July 2025, Google filed a \u201cJohn Doe\u201d lawsuit (PDF) against 25 unidentified defendants accused of operating Badbox 2.0, which Google described as a botnet of over ten million unsanctioned Android streaming devices engaged in advertising fraud. Google said Badbox 2.0, in addition to compromising multiple types of devices prior to purchase, also can infect devices by requiring the download of malicious apps from unofficial marketplaces.\\n\\nGoogle\u2019s lawsuit came on the heels of a June 2025 advisory from the **Federal Bureau of Investigation** (FBI), which warned that cyber criminals were gaining unauthorized access to home networks by either configuring the products with malware prior to the user\u2019s purchase, or infecting the device as it downloads required applications that contain backdoors \u2014 usually during the set-up process.\\n\\nThe FBI said Badbox 2.0 was discovered after the original Badbox campaign was disrupted in 2024. The original Badbox was identified in 2023, and primarily consisted of Android operating system devices (TV boxes) that were compromised with backdoor malware prior to purchase.\\n\\nKrebsOnSecurity was initially skeptical of the claim that the Kimwolf botmasters had hacked the Badbox 2.0 botnet. That is, until we began digging into the history of the qq.com email addresses in the screenshot above.\\n\\n## CATHEAD\\n\\nAn online search for the address **34557257@qq.com** (pictured in the screenshot above as the user \\”**Chen** \\”) shows it is listed as a point of contact for a number of China-based technology companies, including:\\n\\n-**Beijing Hong Dake Wang Science \\u0026 Technology Co Ltd.** \\n-**Beijing Hengchuang Vision Mobile Media Technology Co. Ltd.** \\n-**Moxin Beijing Science and Technology Co. Ltd.**\\n\\nThe website for Beijing Hong Dake Wang Science is**asmeisvip[.]net** , a domain that was flagged in a March 2025 report by **HUMAN Security** as one of several dozen sites tied to the distribution and management of the Badbox 2.0 botnet. Ditto for **moyix[.]com** , a domain associated with Beijing Hengchuang Vision Mobile.\\n\\nA search at the breach tracking service **Constella Intelligence** finds 34557257@qq.com at one point used the password \\”**cdh76111**.\\” Pivoting on that password in Constella shows it is known to have been used by just two other email accounts: **daihaic@gmail.com** and **cathead@gmail.com**.\\n\\nConstella found cathead@gmail.com registered an account at jd.com (China’s largest online retailer) in 2021 under the name \\”\u9648\u4ee3\u6d77,\\” which translates to \\”**Chen Daihai**.\\” According to **DomainTools.com** , the name Chen Daihai is present in the original registration records (2008) for moyix[.]com, along with the email address **cathead@astrolink[.]cn**.\\n\\nIncidentally, astrolink[.]cn also is among the Badbox 2.0 domains identified in HUMAN Security’s 2025 report. DomainTools finds cathead@astrolink[.]cn was used to register more than a dozen domains, including **vmud[.]net** , yet another Badbox 2.0 domain tagged by HUMAN Security.\\n\\n## XAVIER\\n\\nA cached copy of astrolink[.]cn preserved at archive.org shows the website belongs to a mobile app development company whose full name is **Beijing Astrolink Wireless Digital Technology Co. Ltd**. The archived website reveals a \\”Contact Us\\” page that lists a Chen Daihai as part of the company’s technology department. The other person featured on that contact page is **Zhu Zhiyu** , and their email address is listed as **xavier@astrolink[.]cn**.\\n\\n\\n\\nA Google-translated version of Astrolink’s website, circa 2009. Image: archive.org.\\n\\nAstute readers will notice that the user **Mr.Zhu** in the Badbox 2.0 panel used the email address **xavierzhu@qq.com**. Searching this address in Constella reveals a jd.com account registered in the name of Zhu Zhiyu. A rather unique password used by this account matches the password used by the address **xavierzhu@gmail.com** , which DomainTools finds was the original registrant of astrolink[.]cn.\\n\\n## ADMIN\\n\\nThe very first account listed in the Badbox 2.0 panel — \\”admin,\\” registered in November 2020 — used the email address **189308024@qq.com**. DomainTools shows this email is found in the 2022 registration records for the domain **guilincloud[.]cn** , which includes the registrant name \\”**Huang Guilin**.\\”\\n\\nConstella finds 189308024@qq.com is associated with the China phone number **18681627767**. The breach tracking service **osint.industries** reveals this phone number is connected to a Microsoft profile created in 2014 under the name **Guilin Huang (\u6842\u6797 \u9ec4)**. The cyber intelligence platform **Spycloud** says that phone number was used in 2017 to create an account at the Chinese social media platform Weibo under the username \\”**h_guilin**.\\”\\n\\n\\n\\nThe public information attached to Guilin Huang’s Microsoft account, according to the breach tracking service osintindustries.com.\\n\\nThe remaining three users and corresponding qq.com email addresses were all connected to individuals in China. However, none of them (nor Mr. Huang) had any apparent connection to the entities created and operated by Chen Daihai and Zhu Zhiyu — or to any corporate entities for that matter. Also, none of these individuals responded to requests for comment.\\n\\nThe mind map below includes search pivots on the email addresses, company names and phone numbers that suggest a connection between Chen Daihai, Zhu Zhiyu, and Badbox 2.0.\\n\\n\\n\\nThis mind map includes search pivots on the email addresses, company names and phone numbers that appear to connect Chen Daihai and Zhu Zhiyu to Badbox 2.0. Click to enlarge.\\n\\n## UNAUTHORIZED ACCESS\\n\\nThe idea that the Kimwolf botmasters could have direct access to the Badbox 2.0 botnet is a big deal, but explaining exactly why that is requires some background on how Kimwolf spreads to new devices. The botmasters figured out they could trick residential proxy services into relaying malicious commands to vulnerable devices behind the firewall on the unsuspecting user’s local network.\\n\\nThe vulnerable systems sought out by Kimwolf are primarily Internet of Things (IoT) devices like unsanctioned Android TV boxes and digital photo frames that have no discernible security or authentication built-in. Put simply, if you can communicate with these devices, you can compromise them with a single command.\\n\\nOur January 2 story featured research from the proxy-tracking firm **Synthient** , which alerted 11 different residential proxy providers that their proxy endpoints were vulnerable to being abused for this kind of local network probing and exploitation.\\n\\nMost of those vulnerable proxy providers have since taken steps to prevent customers from going upstream into the local networks of residential proxy endpoints, and it appeared that Kimwolf would no longer be able to quickly spread to millions of devices simply by exploiting some residential proxy provider.\\n\\nHowever, the source of that Badbox 2.0 screenshot said the Kimwolf botmasters had an ace up their sleeve the whole time: Secret access to the Badbox 2.0 botnet control panel.\\n\\n\\”Dort has gotten unauthorized access,\\” the source said. \\”So, what happened is normal proxy providers patched this. But Badbox doesn’t sell proxies by itself, so it’s not patched. And as long as Dort has access to Badbox, they would be able to load\\” the Kimwolf malware directly onto TV boxes associated with Badbox 2.0.\\n\\nThe source said it isn’t clear how Dort gained access to the Badbox botnet panel. But it’s unlikely that Dort’s existing account will persist for much longer: All of our notifications to the qq.com email addresses listed in the control panel screenshot received a copy of that image, as well as questions about the apparently rogue ABCD account.”,”published”:”2026-01-26T16:11:38″,”modified”:”2026-01-26T16:11:38″,”type”:”krebs”,”title”:”Who Operates the Badbox 2.0 Botnet?”,”source”:””,”references”:””,”id”:”KREBS:8657B84E0B5E90694CA65B56A6236AC9″,”bulletinFamily”:”blog”,”cwe”:null,”cvelist”:[],”sourceData”:””,”sourceHref”:””,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/krebsonsecurity.com\/2026\/01\/who-operates-the-badbox-2-0-botnet\/”,”category_name”:”News”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-01-26T18:05:09″,”description”:”The cybercriminals in control of **Kimwolf** — a disruptive botnet that has infected more than 2 million devices — recently shared a screenshot indicating they’d…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[6,8,12,119,13,33,7,11,5],"class_list":["post-37255","post","type-post","status-publish","format-standard","hentry","category-category_news","tag-cve","tag-cvss","tag-exploit","tag-krebs","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n