Google Disrupts 1.3 Million-Device Android Botnet Linked to Manufacturer Backdoor

Google has disrupted a massive Android-based botnet consisting of more than 1.3 million devices, primarily TV set-top boxes, following a coordinated takedown in late October.

The operation successfully severed control of the botnet’s servers, halting the malicious activity orchestrated through the compromised hardware.

Allegations of Manufacturer Involvement

Google has expressed high confidence that the device manufacturer, Videostrong, intentionally integrated a backdoor into the set-top boxes. The company alleges that this access was sold to criminal organisations to facilitate illicit operations.

By providing a built-in entry point, the manufacturer enabled attackers to maintain persistent access to a vast network of consumer devices.

Ad Fraud and Traffic Proxying

The botnet was reportedly utilised for large-scale ad fraud and to route malicious internet traffic through the home networks of legitimate device owners. This method allowed criminals to mask their digital footprint by using the IP addresses of unsuspecting consumers, making it significantly harder for security systems to detect or block the activity.

The scale of the incident highlights the risks associated with unvetted Android-based smart home devices and the potential for hardware-level vulnerabilities to compromise consumer networks.