Summary
This technical report presents an analysis of the BADBOX 2.0 botnet, identified as the largest botnet of infected connected TV devices. The report details the collaborative efforts of HUMAN's Satori Threat Intelligence and Research Team alongside partners such as Google and Trend Micro to uncover and disrupt this significant threat. BADBOX 2.0 has been linked to various malicious activities, including programmatic ad fraud, account takeovers, and distributed denial-of-service attacks, affecting over 1 million consumer devices. The report outlines the identification of 109 command-and-control domains as indicators of compromise, along with a comprehensive DNS investigation that revealed numerous email-connected, IP-connected, and string-connected domains associated with the threat. The findings include specific examples of malicious domains and IP addresses, as well as insights into the geographical distribution of these threats. The report emphasizes the importance of continuous monitoring and investigation to mitigate the risks posed by such cyber threats.
