Mirai Variant 'Pandora' Used to Hijack Androiv TVs

A variant of the Mirai botnet, known as Pandora, has been observed infiltrating low-cost Android-based TV sets and TV boxes to use them as part of a botnet for conducting distributed denial-of-service (DDoS) attacks.

According to researchers, these compromises likely occur either during malicious firmware updates or when users install applications for streaming pirated video content.

The analysis suggests that this update may have been made available for download from various websites since it is signed with publicly available Android Open Source Project test keys. The backdoor service is embedded in the boot.img, enabling it to persist between system restarts.

Pandora Spread Through Pirated Movie Streaming Apps

In alternate distribution methods, it is suspected that users are deceived into installing applications for streaming pirated movies and TV shows, primarily targeting Spanish-speaking users. The list of apps involved includes Latino VOD (com.global.latinotvod), Tele Latino (com.spanish.latinomobile), UniTV (com.global.unitviptv), and YouCine TV (com.world.youcinetv).

Once one of these apps is installed, it initiates a background "GoMediaService" service, which is then used to unpack several files, including an interpreter with elevated privileges and an installer for Pandora.

Pandora's purpose is to establish contact with a remote server, replace the system's hosts file with a malicious variant, and receive further instructions for launching DDoS attacks via TCP and UDP protocols and opening a reverse shell.

The primary targets of this campaign are affordable Android TV boxes like Tanix TX6 TV Box, MX10 Pro 6K, and H96 MAX X3, all of which feature quad-core processors from Allwinner and Amlogic, making them suitable for launching DDoS attacks.

To mitigate such infections, it is advisable for users to keep their devices updated and download software exclusively from trusted sources.