Google Cuts Ties After Partner Turns 1.3M Devices Into Botnet
Google has severed ties with a manufacturing partner after discovering that 1.3 million Android devices were secretly weaponized into a massive botnet for financial gain.
Radwan AbdulhadiEditor and technology writer
Anatomy of the Android Botnet Disruption
Google revealed that one of its Android manufacturing partners secretly built a backdoor in 1.3 million devices and turned them into a botnet. The tech giant stated that it has successfully dismantled the backdoor and completely cut ties with the responsible manufacturer, identified as Shenzhen, China-based Videostrong Technology Co. According to detailed reports, Google's investigation into how Videostrong built a backdoor in 1.3 million devices highlights severe supply chain vulnerabilities within the ecosystem.
Following the discovery, Videostrong has been officially banned from building or selling certified Android devices or supplying software for them. Google reported that the malicious infrastructure utilized obfuscation techniques to load malware onto hardware after users booted up their devices for the very first time, completely bypassing initial consumer awareness.
Exploitation and Financial Motives
The infected hardware was leveraged without owners’ knowledge to carry out various forms of malicious activity. Google claims that the backdoor and associated botnet were intentionally developed, deployed, and operated strictly for financial gain. Videostrong allegedly monetized the backdoor by selling access to criminal affiliates and loading those affiliates' malware modules directly onto the compromised systems.
These secondary modules engaged in ad fraud, silently enrolled infected units into residential proxy networks, and loaded supplementary malware onto XCPE-compromised devices. To combat the spread, Google also took decisive action to disrupt the command and control domains operating these affiliate modules, a move expected to sever access for at least 10 million additional compromised devices distributed globally.
Impacted Hardware and Ecosystem Reach
The security breach extended far beyond a single product line. Google noted that the malware was found built directly into many different device models and brands over multiple years. While most of the affected units were Android TV set-top boxes, the sprawling botnet also managed to infect various other Android-based IoT equipment.
The secondary targets included specialized hardware such as telehealth devices, karaoke machines, and digital signage units. Because these affiliates utilized diversified distribution channels beyond XCPE, the scale of the operation demonstrated deep integration across multiple hardware manufacturers.
Regulatory and Policy Responses
In response to the security breach, Google announced that it has implemented significant changes to its review process for device manufacturers. By tightening oversight and validation protocols, the company aims to prevent similar supply chain compromises from happening in the future.
The incident serves as a stark reminder of the security challenges facing connected ecosystems, particularly when third-party manufacturing partners possess deep access to device firmware and boot sequences.
Sources
- The VergeOne of Google’s Android partners turned 1.3 million set-top boxes into a botnet
Continue chronologically
Related entity coverage
Related stories
Google Disrupts XCPE Malware Botnet and Bans TV Box Maker
Google and industry partners dismantle the 1.3 million-device XCPE Android malware botnet, banning Chinese manufacturer Videostrong Technology.
Google shuts down malware backdoor on Android TV boxes
Google has cut ties with device maker Videostrong after discovering a malware backdoor on certified Android TV and Google TV boxes.
Next-Gen Google TV Streamer in Development With Built-In Mics
Google is reportedly developing a next-generation Google TV Streamer featuring built-in microphones, presence sensing, and a new remote control.
Google Chrome Introduces Suspicious Site Warnings
Google Chrome is launching a new two-stage browser safety feature designed to warn users about suspicious and dangerous websites before they visit them.
