Google says it shut down a botnet operation involving Videostrong Technology Co., an OEM and ODM manufacturer that was a certified Android TV partner. According to a Google Cloud blog post, Videostrong deliberately built a backdoor into 1.3 million set-top boxes and sold access to criminal affiliates.
The access enabled affiliates to load hidden software onto the devices. Google said that software was used for ad fraud, to create residential proxy networks and to install malware remotely, potentially targeting device users.
Google described the operation as a sustained effort rather than an isolated incident. The company said it found malicious software built into multiple device models and brands over several years, alongside dedicated infrastructure and changing configurations intended to evade detection and manage affiliates. It said the malware had developed into a more complex, three-stage system by 2024.
Google has ended its business relationship with Videostrong and banned the manufacturer from making devices with Google apps preloaded. The company did not say when the backdoor first appeared. Because Android is open source, Videostrong may still be able to use the operating system in its products.
Sources: Tom's Hardware.