One of Google's Android partners turned 1.3M set-top boxes into a botnet

Google says Shenzhen-based Videostrong Technology secretly installed a backdoor in about 1.3 million devices it manufactured, turning them into a botnet. The company, an Android hardware partner, allegedly built and operated the system for profit, then sold criminal affiliates access to infected devices and loaded their malware onto them. Google has cut ties with Videostrong and barred it from making or selling certified Android devices or supplying software for them.

The compromised devices were used for ad fraud, data theft, unauthorized network traffic, and covert enrollment in residential proxy networks. The malware was embedded in multiple models and brands over several years, mainly Android TV set-top boxes but also other Android-based devices such as telehealth equipment, karaoke machines, and digital signage. Videostrong reportedly used concealed techniques to install the software after devices first booted. Google disrupted the botnet’s command-and-control domains, severing access to the infected equipment and potentially disrupting affiliate malware operations affecting at least 10 million more compromised devices through other distribution channels. The company also says it changed its manufacturer review process in response.