Google, Japan Police Dismantle 1.3 Million-Device Videostrong Botnet
Updated
Updated · The Japan Times · Nov 5
Google, Japan Police Dismantle 1.3 Million-Device Videostrong Botnet
1 articles · Updated · The Japan Times · Nov 5
Summary
Google said it worked with Japan’s National Police Agency and other partners last week to shut a Videostrong backdoor that had turned 1.3 million Android-based devices into residential proxies.
Google said the Shenzhen-based manufacturer appears to have built and operated the malware for profit, selling access to infected set-top boxes, karaoke machines, telehealth devices and digital signage systems to criminal affiliates.
The operators were seen capturing live screenshots, injecting keystrokes and stealing account and device data, while the proxy network helped attackers mask their identities and route malicious traffic through household connections.
Japan’s probe began after a September 2025 unauthorized bank-transfer case in Fukuoka; the NPA says residential proxies were tied to 1,918 fraud cases in 2024, causing about 52.89 billion in losses.
How did a global cybercrime ring hide malicious code inside everyday household appliances for years without detection?
What happens when the manufacturers building our digital devices are the very criminals selling our data?
Could the cheap Android TV box in your living room be secretly draining your bank account right now?
Weaponized Firmware: Videostrong’s 1.3 Million Android TV Box Botnet and the Collapse of Supply Chain Trust
Overview
Videostrong Technology Co. deliberately weaponized its access to factory firmware on certified Android TV set-top boxes, using obfuscation to install the persistent x.cpe backdoor. This allowed the company to covertly convert over 1.3 million devices into a global botnet, selling access to cybercriminal affiliates who used proxy SDKs to route illicit traffic and ad-fraud engines to generate revenue. Standard user actions like uninstallation or factory reset could not remove the malware, as it would automatically reinstall from protected partitions. Google responded by permanently banning Videostrong and, with international partners, dismantled the botnet’s command infrastructure, prompting industry-wide reforms in certification and supply chain security.