BADBOX 2.0 Botnet: Google Sues 25 in China for Android Attack

Google has launched a sweeping legal offensive against 25 unnamed Chinese individuals and entities, seeking to dismantle the massive BADBOX 2.0 botnet targeting Android devices. The tech company filed its lawsuit in a New York federal court, citing ad fraud and widespread device compromise.

The BADBOX 2.0 botnet infiltrated more than 10 million uncertified Android gadgets, ranging from smart TVs to streaming devices and aftermarket automotive systems. Most were manufactured in China using the open-source variant of Android, which often lacks Google’s robust security protections.

How BADBOX Infected Millions

Investigators say cybercriminals loaded malware onto devices before sale or exploited users during setup via malicious apps. Once activated, the infected devices joined a global botnet for ad fraud, click fraud, and the sale of access to compromised networks.

These operations enabled threat actors to mimic real consumer behavior, load ads that never reached any user, and manipulate browsers invisibly. According to Google, the BADBOX network was structured into multiple specialized groups for infrastructure, malware development, app cloning, and ad serving.

Did you know?
The BADBOX 2.0 campaign is suspected to be the largest botnet of exploited connected TV devices ever uncovered, extending its reach well beyond smartphones.

Google’s Legal and Cyber Defense Moves

In response, Google upgraded its Play Protect service, blocking affected apps and automatically scanning for BADBOX infections. The company’s legal action seeks to choke off the infrastructure by working with internet providers and domain registries to block traffic connected to BADBOX.

A preliminary injunction has already forced the takedown of botnet infrastructure around the world. This court order compels ISPs and domain services to quickly isolate and disable malicious servers, with the goal of weakening the botnet’s global command network.

ALSO READ | Google Cloud Joins OpenAI’s Roster, Shaking Up the Battle for AI Supremacy

Human and FBI Warnings Intensify

The FBI, which issued a public warning last month, described BADBOX as a serious and persistent threat, especially in markets like Brazil, the US, Mexico, and Argentina. Security firm HUMAN Security identified the operation as the largest known connected TV botnet in existence.

The attackers’ techniques have evolved from pre-sale device tampering to distributing malicious apps via unofficial app stores, broadening their reach in the consumer market. Many IoT products, such as digital photo frames and streaming devices, continue to be at risk.

The Evolving Threat of Botnets

Cybersecurity experts say the BADBOX 2.0 campaign highlights broader weaknesses in the internet of things supply chain and uncontrolled app ecosystems. Legal takedowns, while impactful, must be paired with consumer awareness and pressure on manufacturers to secure devices from the outset.

As enforcement expands across borders, the pursuit of BADBOX 2.0’s operators could set new legal precedents in prosecuting large-scale cybercrime. Ultimately, industry cooperation, vigilant consumers, and robust law enforcement remain key to countering future botnet threats.