Bigpanzi Botnet Infects Hundreds of Thousands of Android Devices

Security experts have attributed a Distributed Denial of Service (DDoS) botnet, potentially affecting millions of smart TVs and set-top boxes, to an established cybercrime group known as Bigpanzi, active for eight years.

During the peak of the campaign, at least 170,000 bots operated daily, infecting Android-based TVs and streaming devices through pirated apps and firmware updates. The typical infection scenario involved users visiting dubious streaming sites on their smartphones, inadvertently downloading malicious apps to their Android smart TVs.

Once infected, devices were exploited for various cybercrimes, including DDoS attacks and the takeover of other streams, where an attacker replaced content on different channels. An incident in December 2023 in the United Arab Emirates saw regular broadcasts hijacked to display imagery from the conflict between Israel and Palestine.

A Chinese security company warned that the potential for Bigpanzi-controlled TVs and set-top boxes to broadcast violent, terroristic, or explicit content, or use sophisticated AI-generated videos for political propaganda, poses a substantial threat to social order and stability.

Bigpanzi Takes a Page From Mirai's Book

While not detailing the botnet's DDoS history or attributing it to high-profile attacks, researchers noted that its DDoS commands were inherited from the infamous Mirai. The researchers' investigation exposed the pandoraspear malware, associated with Bigpanzi, incorporating 11 Mirai-related DDoS attack vectors in later versions.

Bigpanzi, along with the pandoraspear malware, has been active since at least 2015. Efforts to trace and combat Bigpanzi are ongoing, with a focus on disrupting their operations. The group primarily targeted Brazil, especially Sao Paulo, where a significant number of bots were identified during the peak of the campaign.

The botnet's true scale became apparent when researchers took control of two expired domains used for the botnet's command and control infrastructure. In response, the cybercriminals retaliated by forcing the domains offline.

It is suspected that the group has shifted its DDoS operations to another botnet under their control, using it for more lucrative cybercrimes, such as functioning as a content delivery network. The botnet's current size is believed to exceed the six-figure count recorded at its peak in August, as consumer-grade devices may not be consistently powered on.

January 18, 2024

Cyclonis Backup Details & Terms

The Free Basic Cyclonis Backup plan gives you 2 GB of cloud storage space with full functionality! No credit card required. Need more storage space? Purchase a larger Cyclonis Backup plan today! To learn more about our policies and pricing, see Terms of Service, Privacy Policy, Discount Terms and Purchase Page. If you wish to uninstall the app, please visit the Uninstallation Instructions page.

Cyclonis Password Manager Details & Terms

FREE Trial: 30-Day One-Time Offer! No credit card required for Free Trial. Full functionality for the length of the Free Trial. (Full functionality after Free Trial requires subscription purchase.) To learn more about our policies and pricing, see EULA, Privacy Policy, Discount Terms and Purchase Page. If you wish to uninstall the app, please visit the Uninstallation Instructions page.