Turf War in Your Living Room: ‘Katana’ Botnet Hijacks Android TV Boxes with Custom Rootkits

Nokia ERT reports a Mirai variant called Katana actively infecting unbranded Android TV boxes by leveraging unauthenticated ADB access obtained through residential proxies; Katana performs aggressive bot-killing and ADB port remapping to seize devices and uniquely compiles a kernel Loadable Kernel Module on-device (via TinyCC) for stealthy, long-term persistence, while conducting IPv4-only spoofed attacks. Recommended mitigations include using Google-certified hardware, disabling network ADB/Developer options, and monitoring router-connected devices.