Google says it helped disrupt a botnet of more than 1.3 million Android devices in late October, with the affected devices reportedly consisting mainly of TV set-top boxes. According to the company, the compromised hardware was used for ad fraud and for routing third-party internet traffic through the connections of device owners.

Google also said it is highly confident that device maker Videostrong intentionally included a backdoor in the boxes and then sold access to criminal actors. That allegation is significant, but businesses should note that it is Google's assessment as reported by the source, not an independently verified court finding.

What happened

The reported operation targeted command-and-control infrastructure used to manage a large Android-based botnet. Once that infrastructure was disrupted, the operators lost control over the infected devices.

Based on the source report, the botnet's main functions included:

• Generating ad fraud traffic
• Proxying internet traffic through compromised consumer connections
• Using Android-based connected devices that appear to have been sold with built-in unauthorized access

The case stands out because the alleged compromise was not described as a typical malware infection after purchase. Instead, Google says the backdoor was embedded by the manufacturer, which points to a hardware and firmware supply-chain risk.

Why it matters for European businesses

For European companies, this is more than a consumer-device story. It highlights a broader cybersecurity issue: low-cost connected devices can introduce hidden risk into business networks, remote offices, retail environments and digital signage setups.

Many SMEs use Android-based boxes, smart displays and other inexpensive connected hardware for meeting rooms, reception areas, in-store screens, streaming, testing or kiosk environments. If those devices contain undocumented remote access mechanisms, they can be abused for criminal activity without the owner realizing it.

There are several business implications:

• Network security exposure: A compromised device can become an entry point or persistent risk inside a company network, especially where segmentation is weak.
• Reputation and traffic abuse: If business internet connections are used to relay malicious or suspicious traffic, organisations may face service issues, IP reputation problems or additional scrutiny from providers and partners.
• Ad and analytics distortion: Botnets involved in ad fraud can undermine trust in digital advertising ecosystems, affecting marketers, ad platforms and advertisers that depend on reliable campaign measurement.
• Supply-chain risk: The report reinforces the need to assess device vendors, firmware update practices and security support before deploying connected hardware.

The incident is also relevant to IT and compliance teams because it shows how non-traditional endpoints can create hidden risk. Security planning often focuses on laptops, phones and servers, while set-top boxes, smart devices and embedded Android systems receive less attention.

Who may be affected

• SMEs and founders using low-cost Android devices in offices, stores or shared workspaces
• Retail and e-commerce operators running in-store screens, kiosks or digital signage connected to wider business networks
• Marketing teams and agencies affected by ad fraud risk and unreliable advertising traffic
• IT teams responsible for endpoint visibility, network segmentation and third-party device security
• Managed service providers and digital agencies that install or support smart devices for clients

What companies should consider

• Review connected device inventories: Identify Android-based TV boxes, streaming devices, kiosk systems and similar endpoints in offices, stores and client environments.
• Check vendor trust and support: Prefer suppliers with clear security documentation, update commitments and a credible support model.
• Segment IoT and smart devices: Keep media boxes, signage players and other embedded systems off core business networks where possible.
• Monitor unusual traffic: Look for unexplained outbound connections, proxy-like behaviour or suspicious bandwidth use from non-standard devices.
• Reassess procurement policies: Low upfront hardware cost can create higher downstream security and operational risk.
• Include embedded devices in security audits: These systems should be covered by asset management, patching reviews and incident response planning.

For European businesses, the main lesson is practical: any internet-connected device can become part of a cybercriminal operation if supply-chain controls are weak. Companies that deploy inexpensive smart hardware at scale should treat those devices as security-relevant infrastructure, not as harmless accessories.