A Botnet Built Into the Boxes

Google has disrupted a sprawling Android botnet comprising more than 1.3 million devices — predominantly inexpensive TV set-top boxes — after its command-and-control infrastructure was severed in late October. According to The Hacker News, the takedown represents one of the larger consumer-IoT enforcement actions in recent memory, and it carries an unusual accusation: Google says it is highly confident that a device manufacturer deliberately embedded a backdoor and sold access to criminal operators.

The company identifies Videostrong, a maker of budget streaming hardware, as the party responsible. Rather than a vulnerability exploited after the fact, Google's assessment describes a supply-chain betrayal — malicious functionality baked in before the devices ever reached living rooms.

What the Botnet Was Doing

Two abuse patterns stand out in Google's account.

The first is ad fraud. Compromised boxes were conscripted into schemes that generate fraudulent impressions and clicks, siphoning advertising revenue while remaining largely invisible to the people who owned the hardware. Because set-top boxes sit quietly under televisions and are rarely inspected, they make attractive fraud nodes — always on, broadly distributed, and seldom monitored.

The second is residential proxy abuse. The botnet routed other people's internet traffic through victims' home connections, turning compromised households into anonymizing relays. This is a familiar and particularly troublesome pattern: traffic exiting a residential IP address blends in with legitimate consumer activity, making it valuable for fraud, account takeover, scraping, and other abuse that benefits from a trusted-looking origin.

Both activities share a common trait — they monetize the device without disrupting it. Owners typically notice nothing, which is precisely what makes this class of botnet durable.

The Supply-Chain Allegation

The most consequential element of the disclosure is the attribution. Botnets assembled from cheap IoT hardware are nothing new; what distinguishes this case is the claim that access was intentionally manufactured and commercialized. If accurate, it reframes the threat from "insecure device gets compromised" to "device ships compromised by design."

That distinction matters for defenders and regulators alike. Patching a vulnerability assumes a good-faith vendor. There is no patch for a business model that treats the customer's network as inventory.

Why TV Boxes Keep Appearing in These Cases

The economics of the set-top box market explain much of the risk. Devices are sold at thin margins, differentiated on price rather than security engineering, and frequently run forked or outdated Android builds that receive irregular updates — if they receive any at all. Many are purchased through marketplaces with limited vendor accountability, and they often lack the secure boot and verified firmware chains found on mainstream phones and tablets.

Consumers also tend to treat them as appliances rather than computers. A phone gets updates; a streaming box gets plugged in and forgotten. That combination — weak lifecycle support, low scrutiny, and always-on connectivity — is exactly what botnet operators look for.

What the Takedown Means — and Doesn't

Disrupting command-and-control infrastructure is a meaningful blow. Operators lose their ability to task the fleet, and rebuilding that reach takes time and effort. But takedowns are rarely permanent fixes. The infected devices remain in homes, and unless the malicious component is removed or the hardware is replaced, the underlying exposure persists.

That gap is the recurring lesson of IoT enforcement: server seizures treat the symptom, while the population of compromised endpoints stays largely intact. Google's action also highlights the limits of platform-level response when the problem originates in manufacturing.

Practical Guidance for Organizations and Households

  • Audit what's on the network. Unknown or unmanaged devices on corporate or home networks deserve scrutiny, particularly consumer streaming hardware connected to business infrastructure.
  • Segment where possible. Put IoT and entertainment devices on isolated network segments or guest networks to limit lateral movement and constrain proxy abuse.
  • Buy from vendors with a security track record. Prefer devices with documented update commitments and verifiable firmware.
  • Watch for proxy indicators. Unexplained outbound traffic, unusual bandwidth consumption, or anomalous connections from devices that should be idle are worth investigating.
  • Treat cheap hardware as a risk decision. The lowest-cost option often shifts cost into security and privacy.

The Bigger Picture

This case sits at the intersection of several trends RedSide has tracked: the industrialization of residential proxy networks, the persistence of ad fraud as a funding mechanism, and the difficulty of securing consumer IoT at scale. The allegation against Videostrong, if substantiated, adds a sharper edge — a reminder that supply-chain trust is not a formality but a security control.

For defenders, the takeaway is straightforward. Visibility into every connected device matters, and vendor trust deserves the same scrutiny as technical configuration. For the broader ecosystem, the harder question remains unanswered: how to hold manufacturers accountable when the product itself is the attack.

Original reporting: The Hacker News