Family
Superior
One campaign, two bots. One for Android TV boxes that dresses up in other people's names, and the same operator, now with a second bot in Rust.
Superior is what the bot calls itself, and it’s the name I give the family. It’s a new botnet with no public name, run by a single operator who dresses it up in other people’s names: it wears Kimwolf’s Android package, signs with a Telegram handle that points to Mozi, and antivirus engines file it in the generic Mirai drawer. It’s none of the three.
The box (chapter 35). It gets into Android TV boxes with ADB left open. On top, an app posing as a Google update; underneath, a native bot that, with root, installs itself in /system, deletes apps from the TV, kills the competition and sends its owner reports on what it finds. Uninstalling the app doesn’t get rid of it.
Inside (chapter 36). Borrowed pieces and its own code: its own cryptography and TLS, a mesh between bots that ships switched off, a scare screen, and a few weak spots that are useful for hunting it. Behind it, an operator who measures the install funnel like a product team.
RUSTBOX (chapter 37). The same operator, now with a second bot in Rust: same server, same ADB on 12108, same supervisor, and the same address serving one or the other depending on the day. The code is different, and whether it descends from Superior is still an open question. It spreads on its own through seven routes against routers and cameras, and keeps going about its business even if its server is cut off.
- 35
Uninstalled, and still there
An installer in a hurry drops onto a TV box an app that claims to be a Google update. Inside is a bot that, if it gets root, installs itself in the system, deletes Prime Video and leaves Netflix alone, and brings a face to paint on the screen. And when the owner uninstalls it, it stays.
Superior
2026-11 - 36
Borrowed names
One attack method is called kimwolf, the console signs with Mozi's name, the operator's contact wears the face of a hacker wanted by the FBI and antivirus engines say Mirai. It's none of them. It's a bot all its own, belonging to an operator who dresses up in other people's names, on a domain that has been serving bots for almost nine months.
Superior
2026-11 - 37
Memory safe
The same server that was handing out Superior served another bot one day, written in Rust and with a motto on the door: "memory safe. system optimized." I put it in a sealed cage, made it believe its server was answering, and it told me everything. The most useful part isn't what it does when it's given commands, but what it does without them.
Superior
2026-11