Who Operates the Badbox 2.0 Botnet?

The Kimwolf Botnet's Secret Access to Badbox 2.0

A recent screenshot shared by the Kimwolf botmasters has revealed a shocking connection between the two botnets: Kimwolf has compromised the control panel for Badbox 2.0, a vast China-based botnet powered by malicious software that comes pre-installed on many Android TV streaming boxes. This discovery has significant implications for the cybersecurity community, as it highlights the potential for botnets to collaborate and share resources.

Who Are the Masterminds Behind Badbox 2.0?

The control panel for Badbox 2.0 lists seven authorized users, including one that doesn't quite match the others: "ABCD," which belongs to Dort, a known Kimwolf botmaster. According to our source, Dort somehow figured out how to add their email address as a valid user of the Badbox 2.0 botnet. This raises questions about how Dort gained access to the Badbox botnet panel and what this means for the security of devices associated with Badbox 2.0.

A History of Badbox 2.0

Badbox 2.0 has a storied history that predates Kimwolf's rise in October 2025. In July 2025, Google filed a "John Doe" lawsuit against 25 unidentified defendants accused of operating Badbox 2.0, which Google described as a botnet of over ten million unsanctioned Android streaming devices engaged in advertising fraud. Google said Badbox 2.0 can infect devices by requiring the download of malicious apps from unofficial marketplaces.

The FBI's Warning

The Federal Bureau of Investigation (FBI) warned in June 2025 that cybercriminals were gaining unauthorized access to home networks by either configuring the products with malware prior to the user's purchase or infecting the device as it downloads required applications that contain backdoors. The FBI said Badbox 2.0 was discovered after the original Badbox campaign was disrupted in 2024.

Chen Daihai and Zhu Zhiyu: The Faces Behind Badbox 2.0

A search for the address [email protected] shows it is listed as a point of contact for a number of China-based technology companies, including Beijing Hong Dake Wang Science & Technology Co Ltd. and Beijing Hengchuang Vision Mobile Media Technology Co. Ltd. The website for Beijing Hong Dake Wang Science is asmeisvip[.]net, a domain that was flagged in a March 2025 report by HUMAN Security as one of several dozen sites tied to the distribution and management of the Badbox 2.0 botnet.

The Mind Map

This mind map includes search pivots on the email addresses, company names, and phone numbers that suggest a connection between Chen Daihai, Zhu Zhiyu, and Badbox 2.0.

Unauthorized Access

The idea that the Kimwolf botmasters could have direct access to the Badbox 2.0 botnet is a big deal, but explaining exactly why that is requires some background on how Kimwolf spreads to new devices. The botmasters figured out they could trick residential proxy services into relaying malicious commands to vulnerable devices behind the firewall on the unsuspecting user's local network.

Implications

This discovery has significant implications for the cybersecurity community, as it highlights the potential for botnets to collaborate and share resources. It also raises questions about how Dort gained access to the Badbox botnet panel and what this means for the security of devices associated with Badbox 2.0. The fact that Kimwolf has compromised the control panel for Badbox 2.0 suggests that the botnet may be more powerful and widespread than previously thought.

Forward-Looking Thoughts

The discovery of Kimwolf's access to Badbox 2.0 highlights the need for continued vigilance and cooperation between cybersecurity professionals, law enforcement, and industry stakeholders. As the breakneck pace of technological innovation continues to accelerate, it is essential that we stay ahead of the threats and work together to protect the global digital ecosystem. The implications of this discovery are far-reaching and will likely have a significant impact on the cybersecurity landscape in the months and years to come.

Source: https://krebsonsecurity.com/2026/01/who-operates-the-badbox-2-0-botnet/