WASHINGTON – The Federal Bureau of Investigation issued a public alert on Thursday, cautioning Americans about cyber criminals who are exploiting internet-connected devices in homes to conduct illegal activities through a network known as the BADBOX 2.0 botnet.
Targeting Internet of Things (IoT)
What we know:
According to the FBI, criminals are gaining unauthorized access to home networks by targeting Internet of Things (IoT) devices such as TV streaming boxes, digital projectors, digital picture frames, and aftermarket vehicle infotainment systems. Most of these compromised devices are manufactured in China and are either pre-loaded with malicious software or become infected during setup when users download apps containing hidden backdoors.
What is BADBOX 2.0?
Dig deeper:
Once compromised, these devices become part of BADBOX 2.0—a botnet comprising millions of infected systems used to access residential proxy services, often without the knowledge of consumers. The FBI noted that BADBOX 2.0 is the successor to the original BADBOX campaign, which was disrupted in 2024 after being discovered in 2023. The initial version primarily targeted Android devices compromised with backdoor malware prior to purchase. The updated campaign now also infects devices via unofficial app marketplaces.
Why you should care:
Cyber criminals utilize these infected devices to sell or offer free access to compromised home networks, enabling a wide range of illegal online activities. The FBI listed several signs that may indicate a device is compromised, including the presence of unofficial app marketplaces, devices requiring Google Play Protect to be disabled, streaming devices advertised as “unlocked” or able to access free content, unknown or unverified device brands, Android devices that are not Play Protect certified, and unexplained or suspicious internet traffic.
What you can do:
The FBI is urging the public to assess all IoT devices connected to their home networks and consider disconnecting any device that appears suspicious. Officials also advise consumers to avoid downloading apps from unofficial sources, keep software updated, monitor network activity, and prioritize patching any known vulnerabilities.
The agency acknowledged contributions from Google, Human Security, Trend Micro, and the Shadowserver Foundation in preparing the alert. Anyone who believes they may have been a victim is urged to file a report with the FBI’s Internet Crime Complaint Center at www.ic3.gov.
The Source: The details in this article were provided by the FBI.
