Affected Systems
Android TV boxes and set-top boxes with unauthenticated Android Debug Bridge (ADB) exposed on port 5555. Primarily affects devices accessible via residential proxy services. ARM-based Android IoT devices running vulnerable configurations.
Exploitation Status
Active campaign observed since February 2026. Malware spreads by exploiting unauthenticated ADB instances on local networks, tunneling through residential proxy services. No CVE assigned; exploitation relies on misconfiguration rather than software vulnerability.
Business Impact
Infected devices become DDoS bots capable of HTTP/2 floods with browser fingerprint spoofing, making attack traffic difficult to distinguish from legitimate requests. C2 infrastructure uses Ethereum Name Service (ENS) and Tor for resilience against takedowns. Organizations with Android IoT devices face risk of device compromise, bandwidth abuse, and participation in DDoS attacks. Detection is complicated by process masquerading (netd_service) and legitimate-looking HTTP/2 traffic.
Urgency
🟠Within 24 hours
Recommended Actions
- Audit all Android TV boxes and IoT devices for exposed ADB on port 5555; disable ADB or require authentication if not operationally required
- Block or monitor outbound connections from Android IoT devices to public Ethereum RPC endpoints (0xrpc.io/eth, eth.llamarpc.com, ethereum-rpc.publicnode.com, eth-protect.rpc.blxrbdn.com, eth.merkle.io)
- Monitor for processes masquerading as netd_service on Android devices and Unix domain socket creation matching pattern @n[redacted]boxv7
- Deploy Advanced URL Filtering and Advanced DNS Security to detect ENS domain resolution and Tor .onion traffic from IoT segments
- Segment Android IoT devices on isolated VLANs with strict egress filtering to prevent C2 communication and DDoS participation