Google shuts down 1.3M botnet tied to Android partner

Tech giant Google has revealed that one of its Android manufacturing partners secretly embedded a backdoor into roughly 1.3 million devices without the owners' knowledge, converting the hardware into a sprawling botnet used for illicit financial gain.

The manufacturer responsible has been identified as Videostrong Technology Co., based in Shenzhen, China. Google announced that it has officially severed all ties with the company, banning it from producing or selling certified Android devices as well as supplying any software components for the ecosystem.

Stock photo for illustration only, not from the actual event

Investigations showed that the malware was not limited to a single model, but rather built directly into numerous device brands and variants over a span of several years. While the majority of affected items were Android TV set-top boxes, other Android-based IoT products such as telehealth hardware, karaoke machines, and digital signage displays were also compromised.

"Videostrong monetized the backdoor by selling access to criminal affiliates and loading those affiliates’ malware modules onto infected devices."

Google

According to Google, Videostrong utilized obfuscation techniques to deploy the malware onto users' hardware right after the devices were booted up for the very first time. The infected machines were subsequently harnessed for malicious operations including ad fraud, data exfiltration, and routing unauthorized network traffic.