Google Disrupts 1.3 Million-Device Android Botnet

Google has disrupted a massive botnet comprising more than 1.3 million Android devices, primarily television set-top boxes, following a coordinated takedown in late October.

The operation, led by Google, successfully severed control of the botnet’s command-and-control servers. Investigators believe the scale of the infection was facilitated by intentional vulnerabilities within the hardware itself.

Allegations of Manufacturer Involvement

Google has expressed high confidence that the device manufacturer, Videostrong, intentionally embedded a backdoor into the Android-based set-top boxes. The company alleges that Videostrong sold this access to cybercriminals, allowing them to exploit the devices remotely.

Criminals utilised the compromised devices to conduct large-scale ad fraud and to route unauthorised internet traffic through the home networks of the device owners. This method allowed attackers to mask their activities by leveraging the legitimate IP addresses of unsuspecting consumers.

The disruption marks a significant incident involving supply-chain security, where malicious access is integrated directly into consumer hardware during the manufacturing process.