Bigpanzi Botnet Infects Hundreds of Thousands of Android Devices
Security experts have attributed a Distributed Denial of Service (DDoS) botnet, potentially affecting millions of smart TVs and set-top boxes, to an established cybercrime group known as Bigpanzi, active for eight years.
During the peak of the campaign, at least 170,000 bots operated daily, infecting Android-based TVs and streaming devices through pirated apps and firmware updates. The typical infection scenario involved users visiting dubious streaming sites on their smartphones, inadvertently downloading malicious apps to their Android smart TVs.
Once infected, devices were exploited for various cybercrimes, including DDoS attacks and the takeover of other streams, where an attacker replaced content on different channels. An incident in December 2023 in the United Arab Emirates saw regular broadcasts hijacked to display imagery from the conflict between Israel and Palestine.
A Chinese security company warned that the potential for Bigpanzi-controlled TVs and set-top boxes to broadcast violent, terroristic, or explicit content, or use sophisticated AI-generated videos for political propaganda, poses a substantial threat to social order and stability.
Bigpanzi Takes a Page From Mirai's Book
While not detailing the botnet's DDoS history or attributing it to high-profile attacks, researchers noted that its DDoS commands were inherited from the infamous Mirai. The researchers' investigation exposed the pandoraspear malware, associated with Bigpanzi, incorporating 11 Mirai-related DDoS attack vectors in later versions.
Bigpanzi, along with the pandoraspear malware, has been active since at least 2015. Efforts to trace and combat Bigpanzi are ongoing, with a focus on disrupting their operations. The group primarily targeted Brazil, especially Sao Paulo, where a significant number of bots were identified during the peak of the campaign.
The botnet's true scale became apparent when researchers took control of two expired domains used for the botnet's command and control infrastructure. In response, the cybercriminals retaliated by forcing the domains offline.
It is suspected that the group has shifted its DDoS operations to another botnet under their control, using it for more lucrative cybercrimes, such as functioning as a content delivery network. The botnet's current size is believed to exceed the six-figure count recorded at its peak in August, as consumer-grade devices may not be consistently powered on.
