Google has dismantled a botnet affecting 1.3 million devices after discovering that an Android manufacturing partner secretly installed a backdoor into the hardware. The tech giant stated it has severed ties with the manufacturer, Videostrong Technology Co. based in Shenzhen, China, and banned the company from producing or selling certified Android devices or supplying software for them.
Malicious Activity and Financial Gain
The compromised devices operated without their owners’ awareness to conduct malicious activities, including ad fraud, data exfiltration, and unauthorized network traffic routing. According to Google, the backdoor and botnet were intentionally developed, deployed, and operated for financial gain.
Google explained that Videostrong generated revenue from the backdoor by selling access to criminal affiliates and loading their malware modules onto the affected hardware. These secondary modules engaged in ad fraud, secretly enrolled the devices into residential proxy networks, and loaded extra malware onto the compromised units. Google also disrupted the command and control domains operating those affiliate modules, which the company assesses will sever access to at least 10 million additional compromised devices distributed beyond Videostrong hardware.
Impacted Devices and Security Changes
The malware affected multiple device models and brands across several years rather than a single product. The majority of the affected hardware consisted of Android TV set-top boxes, though the botnet also reached other Android-based Internet of Things devices such as telehealth equipment, karaoke machines, and digital signage systems.
Google reported that Videostrong utilized obfuscation techniques to load the malware onto user devices following the initial hardware bootup. Following the incident, Google updated its review process for device manufacturers.
