Site icon Cybercory

Google Takes Legal Action to Disrupt BADBOX 2.0 Botnet of 10 Million+ Infected IoT Devices

Ouaissou DEMBELE

Good catch, CISOs and cybersecurity professionals: Google, along with partners HUMAN Security and Trend Micro, has filed a lawsuit in New York federal court to take down BADBOX 2.0, a global botnet infecting over 10 million uncertified Android-based IoT devices ranging from set-top boxes to digital picture frames. This breaking-development is critical now, as the FBI has issued a public service announcement warning about the botnet’s role in massive ad fraud, proxy abuse, and more.

On 17 July 2025, Google announced it had initiated civil proceedings in the Southern District of New York, suing unnamed individuals responsible for creating and maintaining BADBOX 2.0. The lawsuit seeks injunctions and damages under US computer crime statutes.

Botnet Scale & Infection Methods

The botnet has compromised more than 10 million IoT devices, many built on the Android Open Source Project (AOSP) and lacking Google Play Protect security. Infection methods include:

Technical Overview (MITRE ATT&CK)

Initial Access  » – Exploitation of pre-installed/drive-by malware  
Execution       » – System binary misuse for ad-fraud payloads  
Persistence     » – Installation of backdoor service  
Command & Con  » – Proxy traffic to C2 infrastructures  
Impact          » – Ad fraud, proxy misuse, data theft

FBI Alert: What You Should Know

On 5 June 2025, the FBI issued PSA I‑060525, cautioning the public about BADBOX 2.0’s ability to co-opt home IoT devices for proxy services, ad fraud, data exfiltration, password theft, account takeover, and DDoS facilitation (Internet Crime Complaint Center). The alert urged users to:

Global and MEA Context

Expert and Official Statements

“While these actions kept our users and partners safe, this lawsuit enables us to further dismantle the criminal operation behind the botnet…” — Google legal filing quoted in PC Gamer (PC Gamer)

“We urge manufacturers, retailers, and consumers to follow the mitigation guidance in the FBI PSA…” — HUMAN Security’s Gavin Reid (HUMAN Security)

At‑Home Detection Indicators

The FBI listed key signs of a BADBOX infection (Internet Crime Complaint Center):

Actionable Takeaways for Security Leaders

  1. Audit networked IoT devices, especially generic Android-based gadgets (smart TVs, digital frames, etc.).
  2. Enforce routers/firewalls to whitelist only known devices and monitor unusual outbound traffic.
  3. Activate Google Play Protect on any Android-based device; block uncertified units.
  4. Block unofficial app stores and prevent sideloaded app installs via policy.
  5. Educate users and staff on IoT risks—early-stage training essential.
  6. Engage in IoT pentesting across networked home-office devices (pentesting).
  7. Deploy network monitoring tools for anomaly detection (DNS, proxy, ad-request patterns).
  8. Stay current with news on IoT fraud and botnet developments.
  9. Advocate for vendor accountability and secure device boot firmware across MEA markets.
  10. Establish an IoT ownership framework to track device origin, certification, and patches.

Conclusion

Google’s lawsuit marks a pivotal move toward tackling IoT-based ad fraud and proxy botnets like BADBOX 2.0. With over 10 million devices compromised, including those in MEA countries, the incident is a wake-up call for stronger device certification, vigilant home-network security, and cross-sector cooperation. As law enforcement and tech firms continue their disruption, organizations must zero-in on IoT governance, proactive awareness initiatives, and comprehensive monitoring to prevent falling prey to the next generation of bot-driven threats.

Sources

Exit mobile version