Google Cuts Ties With Android Partner Videostrong Over 1.3 Million-Device Botnet

Google has severed business ties with Shenzhen-based hardware manufacturer Videostrong Technology Co. after discovering the partner intentionally embedded backdoors into roughly 1.3 million Android devices to operate a commercial botnet, according to reporting by The Verge (https://www.theverge.com/tech/1024807/google-botnet-android-tv-shut-down).

Google stated that it has dismantled the illicit backdoor and permanently barred Videostrong from building or selling certified Android devices or supplying software for them. The compromised hardware spanned multiple brands and product categories over several years, predominantly affecting Android TV set-top boxes alongside Internet-of-Things equipment such as digital signage, karaoke machines, and telehealth hardware.

According to Google, Videostrong monetized the backdoor by selling device access to cybercriminal affiliates. Those third parties loaded secondary malware modules designed to conduct automated ad fraud, exfiltrate user data, and silently enroll hardware into residential proxy networks that route unauthorized web traffic.

To evade standard audits, Videostrong used code obfuscation techniques that loaded the malware onto devices only after consumers completed their initial setup and boot sequence. Google said it also took action against the command-and-control (C2) domains coordinating the affiliate modules. Because those criminal networks relied on diversified distribution channels beyond the initial compromised firmware, Google estimated that neutralizing the C2 domains severed illicit access to at least 10 million additional compromised devices worldwide.

The incident highlights persistent supply-chain vulnerabilities within the certified Android hardware ecosystem, where third-party original equipment manufacturers produce white-label consumer electronics under diverse brand names. Google confirmed that it has updated its technical review and verification procedures for third-party device manufacturers following the investigation.