Google said it disrupted command-and-control servers for a botnet of more than 1.3 million Android devices, mostly TV set-top boxes, in a late-October operation it attributes with high confidence to Shenzhen manufacturer Videostrong Technology Co.^1,2.

The company said Videostrong built a persistent firmware backdoor, tracked as x.cpe, into many device models and brands over several years and sold access to criminal affiliates, according to reporting on Google's threat-intelligence post^1,2.

Google said it used legal action to take down domains and servers that controlled the botnet and the control domains of more than a dozen malware families loaded through the backdoor^1,2.

Japan's National Police Agency and companies including Lumen, HUMAN Security, Plume, Synthient and TrendAI worked with Google, both outlets reported^1,2.

Google said the related-family takedown should cut operators' access to at least 10 million additional compromised devices, not all of them Android, including some retail set-top boxes, karaoke machines and telehealth hardware².

TrendAI counted 1,472,554 infected devices across 206 models between June 3 and Oct. 1, with the largest counts in Malaysia, Brazil, Iraq, Mexico and Taiwan, The Hacker News reported¹.

Google said the backdoor runs as a system app, can disable Play Protect, install software silently, capture screens, inject keystrokes and open reverse shells^1,2.

Affiliates used modules for ad fraud and residential proxies that route third-party traffic through owners' home connections, BleepingComputer reported, naming services including Linkfog, Honeygain, GaGaNode, NetNut and Traffmonetizer².

Google has cut ties with Videostrong, banned it and future affiliates from certified Android devices, and said it changed its certification review after finding obfuscation that hid malicious code until after first boot^1,2.

The backdoor remains on devices and reinstalls from firmware if removed; Google, TrendAI and Synthient said cleanup needs vendor action, replacement or disconnecting the box^1,2.

Videostrong's public response was not reported. Google's attribution is its own assessment; partners named in the operation include Synthient and Plume^1,2.