Azerbaijan Warns BADBOX 2.0 Botnet in TV Boxes Hit State Sites

The National Cybersecurity Agency (MKA) of Azerbaijan has issued a security advisory warning the public and commercial entities about malicious components linked to the BADBOX 2.0 botnet campaign pre-installed on select Android TV box devices sold across the country.

According to agency disclosures, distributed denial-of-service (DDoS) campaigns targeted several government web resources in October 2026. Forensic log analysis revealed that segments of the attack traffic originated from domestic IP addresses directly linked to Android TV box hardware. Investigations confirmed that the firmware of compromised device batches came infected at the factory manufacturing or supply-chain distribution stages, allowing threat actors persistent remote execution capabilities. Because the backdoor resides within the read-only system firmware, traditional factory resets fail to sanitize the compromise.

MKA advises consumers and corporate IT administrators against purchasing unverified Android media boxes and projectors, urging users to disconnect suspicious devices, segregate IoT equipment from primary enterprise networks, and report anomalies to the National CERT. Specific indicators of compromise (IoCs) have been distributed via the ⁠misp.cert.az⁠ threat intelligence exchange platform.