The cybercriminals in command of Kimwolf — a disruptive botnet that has contaminated greater than 2 million gadgets — lately shared a screenshot indicating they’d compromised the management panel for Badbox 2.0, an unlimited China-based botnet powered by malicious software program that comes pre-installed on many Android TV streaming packing containers. Each the FBI and Google say they’re attempting to find the folks behind Badbox 2.0, and due to bragging by the Kimwolf botmasters we could now have a a lot clearer thought about that.
Our first story of 2026, The Kimwolf Botnet is Stalking Your Native Community, detailed the distinctive and extremely invasive strategies Kimwolf makes use of to unfold. The story warned that the overwhelming majority of Kimwolf contaminated methods have been unofficial Android TV packing containers which can be usually marketed as a solution to watch limitless (pirated) film and TV streaming providers for a one-time charge.
Our January 8 story, Who Benefitted from the Aisuru and Kimwolf Botnets?, cited a number of sources saying the present directors of Kimwolf glided by the nicknames “Dort” and “Snow.” Earlier this month, a detailed former affiliate of Dort and Snow shared what they mentioned was a screenshot the Kimwolf botmasters had taken whereas logged in to the Badbox 2.0 botnet management panel.
That screenshot, a portion of which is proven under, exhibits seven licensed customers of the management panel, together with one which doesn’t fairly match the others: In keeping with my supply, the account “ABCD” (the one that’s logged in and listed within the prime proper of the screenshot) belongs to Dort, who in some way discovered easy methods to add their electronic mail deal with as a legitimate person of the Badbox 2.0 botnet.
The management panel for the Badbox 2.0 botnet lists seven licensed customers and their electronic mail addresses. Click on to enlarge.
Badbox has a storied historical past that nicely predates Kimwolf’s rise in October 2025. In July 2025, Google filed a “John Doe” lawsuit (PDF) in opposition to 25 unidentified defendants accused of working Badbox 2.0, which Google described as a botnet of over ten million unsanctioned Android streaming gadgets engaged in promoting fraud. Google mentioned Badbox 2.0, along with compromising a number of kinds of gadgets prior to buy, can also infect gadgets by requiring the obtain of malicious apps from unofficial marketplaces.
Google’s lawsuit got here on the heels of a June 2025 advisory from the Federal Bureau of Investigation (FBI), which warned that cyber criminals have been gaining unauthorized entry to dwelling networks by both configuring the merchandise with malware previous to the person’s buy, or infecting the gadget because it downloads required purposes that include backdoors — often throughout the set-up course of.
The FBI mentioned Badbox 2.0 was found after the unique Badbox marketing campaign was disrupted in 2024. The unique Badbox was recognized in 2023, and primarily consisted of Android working system gadgets (TV packing containers) that have been compromised with backdoor malware prior to buy.
KrebsOnSecurity was initially skeptical of the declare that the Kimwolf botmasters had hacked the Badbox 2.0 botnet. That’s, till we started digging into the historical past of the qq.com electronic mail addresses within the screenshot above.
CATHEAD
An internet seek for the deal with 34557257@qq.com (pictured within the screenshot above because the person “Chen“) exhibits it’s listed as a degree of contact for various China-based know-how corporations, together with:
–Beijing Hong Dake Wang Science & Know-how Co Ltd.
–Beijing Hengchuang Imaginative and prescient Cellular Media Know-how Co. Ltd.
–Moxin Beijing Science and Know-how Co. Ltd.
The web site for Beijing Hong Dake Wang Science is asmeisvip[.]web, a website that was flagged in a March 2025 report by HUMAN Safety as one in all a number of dozen websites tied to the distribution and administration of the Badbox 2.0 botnet. Ditto for moyix[.]com, a website related to Beijing Hengchuang Imaginative and prescient Cellular.
A search on the breach monitoring service Constella Intelligence finds 34557257@qq.com at one level used the password “cdh76111.” Pivoting on that password in Constella exhibits it’s recognized to have been utilized by simply two different electronic mail accounts: daihaic@gmail.com and cathead@gmail.com.
Constella discovered cathead@gmail.com registered an account at jd.com (China’s largest on-line retailer) in 2021 beneath the title “陈代海,” which interprets to “Chen Daihai.” In keeping with DomainTools.com, the title Chen Daihai is current within the unique registration information (2008) for moyix[.]com, together with the e-mail deal with cathead@astrolink[.]cn.
By the way, astrolink[.]cn is also among the many Badbox 2.0 domains recognized in HUMAN Safety’s 2025 report. DomainTools finds cathead@astrolink[.]cn was used to register greater than a dozen domains, together with vmud[.]web, one more Badbox 2.0 area tagged by HUMAN Safety.
XAVIER
A cached copy of astrolink[.]cn preserved at archive.org exhibits the web site belongs to a cellular app improvement firm whose full title is Beijing Astrolink Wi-fi Digital Know-how Co. Ltd. The archived web site reveals a “Contact Us” web page that lists a Chen Daihai as a part of the corporate’s know-how division. The opposite particular person featured on that contact web page is Zhu Zhiyu, and their electronic mail deal with is listed as xavier@astrolink[.]cn.
A Google-translated model of Astrolink’s web site, circa 2009. Picture: archive.org.
Astute readers will discover that the person Mr.Zhu within the Badbox 2.0 panel used the e-mail deal with xavierzhu@qq.com. Looking out this deal with in Constella reveals a jd.com account registered within the title of Zhu Zhiyu. A slightly distinctive password utilized by this account matches the password utilized by the deal with xavierzhu@gmail.com, which DomainTools finds was the unique registrant of astrolink[.]cn.
ADMIN
The very first account listed within the Badbox 2.0 panel — “admin,” registered in November 2020 — used the e-mail deal with 189308024@qq.com. DomainTools exhibits this electronic mail is discovered within the 2022 registration information for the area guilincloud[.]cn, which incorporates the registrant title “Huang Guilin.”
Constella finds 189308024@qq.com is related to the China telephone quantity 18681627767. The open-source intelligence platform osint.industries reveals this telephone quantity is linked to a Microsoft profile created in 2014 beneath the title Guilin Huang (桂林 黄). The cyber intelligence platform Spycloud says that telephone quantity was utilized in 2017 to create an account on the Chinese language social media platform Weibo beneath the username “h_guilin.”
The general public info connected to Guilin Huang’s Microsoft account, in line with the breach monitoring service osintindustries.com.
The remaining three customers and corresponding qq.com electronic mail addresses have been all linked to people in China. Nonetheless, none of them (nor Mr. Huang) had any obvious connection to the entities created and operated by Chen Daihai and Zhu Zhiyu — or to any company entities for that matter. Additionally, none of those people responded to requests for remark.
The thoughts map under contains search pivots on the e-mail addresses, firm names and telephone numbers that recommend a connection between Chen Daihai, Zhu Zhiyu, and Badbox 2.0.
This thoughts map contains search pivots on the e-mail addresses, firm names and telephone numbers that seem to attach Chen Daihai and Zhu Zhiyu to Badbox 2.0. Click on to enlarge.
UNAUTHORIZED ACCESS
The concept the Kimwolf botmasters may have direct entry to the Badbox 2.0 botnet is a giant deal, however explaining precisely why that’s requires some background on how Kimwolf spreads to new gadgets. The botmasters discovered they may trick residential proxy providers into relaying malicious instructions to susceptible gadgets behind the firewall on the unsuspecting person’s native community.
The susceptible methods sought out by Kimwolf are primarily Web of Issues (IoT) gadgets like unsanctioned Android TV packing containers and digital photograph frames that don’t have any discernible safety or authentication built-in. Put merely, in the event you can talk with these gadgets, you possibly can compromise them with a single command.
Our January 2 story featured analysis from the proxy-tracking agency Synthient, which alerted 11 totally different residential proxy suppliers that their proxy endpoints have been susceptible to being abused for this sort of native community probing and exploitation.
Most of these susceptible proxy suppliers have since taken steps to stop clients from going upstream into the native networks of residential proxy endpoints, and it appeared that Kimwolf would now not be capable to rapidly unfold to hundreds of thousands of gadgets just by exploiting some residential proxy supplier.
Nonetheless, the supply of that Badbox 2.0 screenshot mentioned the Kimwolf botmasters had an ace up their sleeve the entire time: Secret entry to the Badbox 2.0 botnet management panel.
“Dort has gotten unauthorized entry,” the supply mentioned. “So, what occurred is regular proxy suppliers patched this. However Badbox doesn’t promote proxies by itself, so it’s not patched. And so long as Dort has entry to Badbox, they’d be capable to load” the Kimwolf malware immediately onto TV packing containers related to Badbox 2.0.
The supply mentioned it isn’t clear how Dort gained entry to the Badbox botnet panel. However it’s unlikely that Dort’s current account will persist for for much longer: All of our notifications to the qq.com electronic mail addresses listed within the management panel screenshot obtained a replica of that picture, in addition to questions concerning the apparently rogue ABCD account.
