D3ada55 says she is a senior sales engineer at CENSUS.
Explicit Confidence 99% · D3ada55 EP 172 Details
“now I’m over at CENSUS”
Episode
07 April 2026 Official episode · Official transcript
advanced persistent threat cybercrime
The episode examines malicious Android streaming devices, especially SuperBox devices, their network behavior, distribution and marketing, the BadBox botnet, and the risks posed to home and corporate networks.
Topics: Malicious Android streaming devices, BadBox and BadBox 2.0, Botnets and DDoS-as-a-service, Residential proxy networks, Local-network reconnaissance and device discovery, ARP flooding and device impersonation, Unauthenticated Android Debug Bridge access, Root shells and firmware analysis, Hidden or missing firmware partitions, Remote-access software on IoT devices, Packet capture and traffic analysis, APK decompilation and cleartext data transmission, Compromised IoT devices in home networks, Home-network segmentation and corporate VPN exposure, Influencer marketing and reseller-based distribution of malicious devices, IoT supply-chain and regulatory risks, Network bandwidth abuse and possible data exfiltration, Bluetooth and covert radio capabilities, Zero-trust operation in hostile environments
Links published on the Darknet Diaries episode page. Not LLM output.
Qualified statements from this episode, not graph facts.
D3ada55 says she is a senior sales engineer at CENSUS.
Explicit Confidence 99% · D3ada55 EP 172 Details
“now I’m over at CENSUS”
D3ada55 says she worked at Palo Alto.
Explicit Confidence 98% · D3ada55 EP 172 Details
“I’ve worked at some of the biggest names in security, so Palo Alto, Google, Apple.”
D3ada55 says she worked at Google.
Explicit Confidence 98% · D3ada55 EP 172 Details
“I’ve worked at some of the biggest names in security, so Palo Alto, Google, Apple.”
SuperBox DISCOVERED_BY D3ada55
D3ada55 investigated and discovered suspicious behavior in a SuperBox taken from her father’s house.
Derived Confidence 92% · Jack Rhysider EP 172 Details
“D3ada55 discovered something that was like discovering something you weren’t supposed to see”
D3ada55 USES Packet Squirrel
D3ada55 used a Packet Squirrel to perform inline packet captures of the SuperBox traffic.
Explicit Confidence 99% · D3ada55 EP 172 Details
“I got one of those Packet Squirrels from Hak5”
D3ada55 ran tcpdump on Raspberry Pis while monitoring the boxes’ network activity.
Explicit Confidence 99% · D3ada55 EP 172 Details
“I’ve got tcpdump running on them”
D3ada55 suspected that the boxes were using Nmap to scan a Raspberry Pi.
Uncertain Confidence 90% · D3ada55 EP 172 Details
“are you guys nmapping this little Raspberry Pi in here?”
SuperBox ASSOCIATED_WITH Tencent
The SuperBox was observed communicating with Tencent infrastructure.
Explicit Confidence 99% · D3ada55 EP 172 Details
“The first thing it does is call out to Tencent.”
D3ada55 identifies the Tencent communication as involving QQ/qq.com.
Explicit Confidence 98% · D3ada55 EP 172 Details
“Like, in China, yeah, like qq.com.”
SuperBox EXPLOITS SCADA vulnerability
The SuperBox triggered an alert for a SCADA vulnerability, which the episode presents as an attempted SCADA exploit.
Explicit Direction flagged Confidence 93% · D3ada55 EP 172 Details
“I get a hit in my vulnerability log, like in the threat log on my Palo Alto firewall, and it’s for a SCADA vulnerability.”
SuperBox USES ARP denial-of-service
The SuperBox generated enough ARP traffic to overwhelm devices and cause them to lose their IP address reservations.
Explicit Confidence 99% · D3ada55 EP 172 Details
“it was almost more of like an ARP DOS, because it was arping at things so hard that they would freak out and lose their IP address reservation.”
SuperBox USES Address Resolution Protocol
The SuperBox sent ARP requests to every IP address on the local network.
Explicit Confidence 99% · Jack Rhysider EP 172 Details
“this SuperBox was arping out to every IP in D3ada55’ network.”
SuperBox USES network scanning
The SuperBox actively scanned and probed other devices on the local network.
Explicit Confidence 99% · D3ada55 EP 172 Details
“they’re doing that discovery when they get on a network to see what’s on the network.”
SuperBox USES Residential proxy network
D3ada55 links the boxes’ large bandwidth consumption to residential proxy activity.
Explicit Confidence 97% · D3ada55 EP 172 Details
“Then when you factor in the residential proxy stuff, that’s a lot of bandwidth.”
The SuperBox runs Android rather than Android TV.
Explicit Confidence 99% · Jack Rhysider EP 172 Details
“the operating system on this thing is just Android, and not Android TV, just Android.”
SuperBox USES TeamViewer
The SuperBox contains TeamViewer, providing a possible remote-management capability.
Explicit Confidence 99% · D3ada55 EP 172 Details
“there’s TeamViewer on it, right? Like, why does it have TeamViewer?”
SuperBox USES Android Debug Bridge
The SuperBox exposes Android Debug Bridge without authentication and allowed a root shell.
Explicit Confidence 99% · D3ada55 EP 172 Details
“there’s no authentication on it. I was able to connect just straight across the Android Debug Bridge”
“it gave me a root shell.”
SuperBox USES SuperBox App Store
The SuperBox requires its own app store instead of the Google Play Store to access its streaming applications.
Explicit Confidence 99% · Jack Rhysider EP 172 Details
“install something called the SuperBox App Store.”
BadBox 2.0 VARIANT_OF BadBox
The episode says the newer malware was designated BadBox 2.0 even though the first BadBox had been shut down.
Explicit Confidence 99% · Jack Rhysider EP 172 Details
“it’s still BadBox, but it’s BadBox 2.0 even though we had shut down the first BadBox.”
SuperBox ASSOCIATED_WITH BadBox 2.0
D3ada55 identifies the SuperBox as part of what was being called the BadBox botnet, specifically in the BadBox 2.0 context.
Explicit Confidence 97% · D3ada55 EP 172 Details
“this thing was part of what’s now referred to as the BadBox botnet.”
Jack states that Dort made the Kimwolf botnet and controls the infected SuperBoxes; this is presented as the episode’s account.
Explicit Confidence 97% · Jack Rhysider EP 172 Details
“this guy, Dort, who’s the one who made the Kimwolf botnet, controls the SuperBoxes.”
SuperBox ASSOCIATED_WITH Kimwolf
D3ada55 confirms that SuperBoxes were part of the Kimwolf botnet.
Explicit Confidence 99% · D3ada55 EP 172 Details
“They were confirmed as part of that botnet.”
The Kimwolf botnet is described as launching large-scale DDoS attacks and operating as a DDoS-for-hire service.
Explicit Confidence 99% · Jack Rhysider EP 172 Details
“the Kimwolf botnet is a DDOS-as-a-service business.”
Aisuru-Kimwolf botnet USES DDoS
Cloudflare reportedly identified Aisuru-Kimwolf as the busiest botnet and mitigated more than 2,000 attacks originating from it.
Attributed Confidence 95% · D3ada55 EP 172 Details
“Cloudflare put out a report that talks about the DDoS statistics for the year for 2025”
“over 2,000 attacks they mitigated originating from this botnet”
vSeeBox ASSOCIATED_WITH SuperBox
The vSeeBox exhibited similar characteristics to the SuperBox and communicated with Tencent infrastructure; the episode presents the devices as related.
Explicit Confidence 96% · D3ada55 EP 172 Details
“it’s also beaconing straight to China via Tencent infrastructure.”
“they all start talking to each other.”
Magabox ASSOCIATED_WITH SuperBox
The Magabox looked and behaved like the SuperBox, including using a similar app-store and video-app arrangement.
Explicit Confidence 96% · D3ada55 EP 172 Details
“it looked just like the SuperBox.”
“it worked like the other two.”
SuperBox ASSOCIATED_WITH Pre-positioning
Jack speculates that the boxes may be a pre-positioning move, while acknowledging that the final intent is unknown.
Uncertain Confidence 78% · Jack Rhysider EP 172 Details
“It’s possible that all this is just some pre-positioning move of some kind”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T08:57:11.523769+00:00