Google discovered that Videostrong Technology Co., a Shenzhen-based Android manufacturing partner, intentionally built a backdoor into 1.3 million set-top boxes and other devices, converting them into a botnet. Google says it has dismantled the backdoor, severed ties with Videostrong, and banned the company from building or selling certified Android devices or supplying software for them.
The infected devices were used for ad fraud, data exfiltration, and routing unauthorized network traffic. Google states that Videostrong monetized the backdoor by selling access to criminal affiliates and loading their malware modules onto compromised devices. Those modules conducted ad fraud, silently enrolled devices into residential proxy networks, and loaded additional malware. Google also disabled command and control domains operating these affiliate modules, assessing that taking them down will sever access to at least 10 million additional compromised devices across the affiliates' distribution channels.
The malware was built directly into multiple device models and brands over several years. Most affected devices were Android TV set-top boxes, but the botnet also infected other Android-based IoT devices, including telehealth devices, karaoke machines, and digital signage devices. Google says Videostrong used obfuscation techniques to load the malware after users first booted the hardware. Following the incident, Google made changes to its review process for device manufacturers.