Isophoric News · Tuesday, November 3, 2026
Google says a Chinese TV box maker built a backdoor into 1.3 million devices, and it has taken the botnet down
Google and industry partners dismantled a botnet of more than 1.3 million Android TV set-top boxes last week, and Google said it assessed "with high confidence" that the device maker Videostrong Technology Co. intentionally built and ran the backdoor for financial gain, according to a post by Google's Threat Intelligence Group published Monday. Google said it had cut ties with the Shenzhen, China, company, banned it and any future affiliates from building certified Android devices or supplying software to certified vendors, and taken legal action against the domains and servers that controlled the botnet. Google said Videostrong sold access to criminal affiliates whose add-on modules ran ad fraud and turned the boxes into residential proxies, which pass strangers' internet traffic through the owners' home connections, and that taking down the affiliates' control servers should cut off access to at least 10 million more compromised devices. Japan's National Police Agency and the firms Lumen, HUMAN Security, Plume, Synthient and TrendAI worked on the operation, Google said. The backdoor sits in the firmware and reinstalls itself if removed, so it is still on the boxes, BleepingComputer and The Hacker News reported, and Synthient told consumers to throw the devices away, according to The Hacker News. Videostrong did not immediately respond to The Register, and none of the reports carries a response from the company.
Source A · Source B · Source C · Source D · Source E · Source F