Google has dismantled a botnet involving 1.3 million Android-based devices, primarily set-top boxes, that contained a hidden backdoor. The company identified the manufacturer as Shenzhen-based Videostrong Technology Co., which has now been banned from producing or supplying software for certified Android hardware.
The backdoor was used for malicious activities, including ad fraud, data exfiltration, and unauthorized network traffic routing. Google reports that Videostrong monetized the access by selling it to criminal affiliates who deployed additional malware modules on the infected devices.
The compromise affected various Android-based IoT hardware, including karaoke machines, digital signage, and telehealth equipment. These devices were infected over several years using obfuscation techniques that activated the malware upon the initial boot of the hardware.
In addition to cutting ties with Videostrong, Google disrupted the command and control domains associated with the affiliate modules. This action is expected to cut off access to at least 10 million other devices compromised through the same distribution channels.
Following the incident, Google implemented changes to its review process for device manufacturers to prevent similar security breaches in the future.
