Bigpanzi botnet infects 170,000 Android TV boxes with malware

**Bigpanzi** is a long-running cybercrime syndicate that has infected Android TV and eCos set-top boxes since at least 2015 using backdoored firmware and malicious apps; researchers observed custom malware (pandoraspear and pcdn) that establishes C2, hijacks DNS, supports reverse shells and DDoS, and builds a P2P CDN, with an estimated peak of ~170,000 daily active bots and 1.3 million unique IPs observed globally (notably Brazil).