Google Threat Intelligence Group (GTIG) published the takedown on Nov 2. Partners were Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI.

• Who: Google assesses with high confidence that Videostrong Technology Co., an Android OEM/ODM, intentionally developed and operated the backdoor and sold access to criminal affiliates. Google says it was not a rogue insider or an oversight, and that Videostrong used obfuscation to load malicious code after first boot, slipping past Android certification tests.
• How it works: a stub (x.cpe, com.oemservice in some builds) is preloaded in the firmware at android.uid.system privilege and reinstalls itself from /oem/ if removed. It fetches config over HTTP, then takes orders over MQTT: silent app installs (after disabling Play Protect verification), shell commands as the system user, screen capture, keystroke injection and network reconnaissance. Modules turned devices into residential-proxy exit nodes and ad-fraud engines or loaded further backdoors.
• Action taken: legal takedown of Videostrong's C2 and staging domains and servers, and of C2 domains for over a dozen affiliate malware families; Google expects the affiliate takedown to sever access to at least 10 million additional compromised devices. Videostrong and any future affiliates are banned from certified Android.
• Scale: TrendAI counted 1,472,554 infected devices across 206 models between Jun 3 and Oct 1. Mostly TV boxes, but also telehealth devices, karaoke machines and digital signage.

What to do: owners cannot remove a firmware backdoor themselves. Treat no-name Android TV boxes, especially MECOOL-branded ones Synthient ties to Videostrong, as untrusted: take them off networks that hold anything sensitive, or replace them with Play Protect certified devices. Synthient publishes a list of 182 model names seen in the campaign but notes a model name alone does not prove infection. Network indicators and detection ideas are in the companion hunting item.