Certified Android TV manufacturer put unauthorized backdoor in 1.3 million set-top boxes, Google reveals — OEM sold access to criminal affiliates, used massive network as botnet for ad fraud, resident

Google just shut down a massive botnet operation involving an OEM and ODM manufacturer. According to the company blog, Videostrong Technology Co., which was a certified Android TV partner, purposefully installed a backdoor into 1.3 million set-top boxes and then sold access to criminal affiliates. This allowed for the installation of hidden software that the bad actors could use to conduct ad fraud, build residential proxy networks, and even remotely install malware on the device itself to target the end-user.

“Videostrong monetized the backdoor by selling access to criminal affiliates and loading those affiliates’ malware modules onto infected devices,” the company said in the Google Cloud blog post. It also added, “We found this malicious software built directly into many different device models and brands over multiple years, supported by dedicated infrastructure and constantly evolving configurations to evade detection and manage their affiliates. We believe this campaign wasn’t an isolated rogue insider or a development oversight. As a result, Google has cut ties with Videostrong and banned them from making devices with preloaded Google apps.”

While Google did not mention when Videostrong started loading malware into its products, the company said that the pre-installed malware evolved into a complex, three-stage design in 2024. This meant that the manufacturer has been exploiting millions of devices for years now, with the latest developments designed to make the malware more resilient and allow for multiple bad actors to take advantage of the system. Even though the company has already terminated its business relationship with Videostrong, the open-source nature of Android means that it could continue using the operating system on its products.

There have been supply chain attacks in the past, wherein a third-party compromises a trusted product to steal data, like some Ledger hardware wallets that have been sold by a reseller in Southeast Asia and Europe. Although Google did not characterize this as a supply chain attack, as it was perpetrated by the manufacturer itself and not a third-party operator, it still compromised a supposedly trusted operating system, leading to millions of victims. This incident also shows how even the simplest of devices can be used to execute complicated attacks, like how a Chinese couple hid a PC behind a fridge in a Japanese hotel and targeted 2.4 million victims.