- Scientists find a new variant of VO1D Botnet
- It seems to be designed to be an anonymous proxy
- On top, it counted nearly 1.6 million units
If you are an Android -TV user, note -there is a new and dangerous botnet that infects endpoints left and right.
CyberSecurity researchers from XLAB have begun to track a new variant of VO1D Malicious Botnet, which for a period of time only a few months grew to approx. 1.6 million units in 226 countries. The size of the botnet varies from day to day, and while it peaked in mid -January 2025, it currently counts about 800,000 units, the researchers said.
The initial infection vector is unknown at present, but most of the victims are placed in Brazil (25%), followed by South Africa (13.6%), Indonesia (10.5%), Argentina (5.3%), Thailand (3.4%) and China (3.1%).
Botnet for rent
A botnet can be used for many things, including distributed denial of service (DDOS) attacks, housing proxy, ad manipulation and more. In this case, VO1D is used as an anonymous proxy that redirects criminal traffic and is mixed with legitimate consumer traffic. It comes with advanced encryption, strong infrastructure powered by DGA and advanced clearing techniques.
As the number of infected devices varies greatly from day to day, researchers believe that criminals “rent” units as proxy servers.
“We speculate that the phenomenon of” fast waves followed by sharp falls “can be attributed to VO1D leasing of its botnet infrastructure in specific regions of other groups,” they said. So during the days when VO1D had significantly fewer bots, “they gave” probably just the devices to another to use.
Android TV devices infected with malware will behave unusual. They will be sluggish, they will randomly show ads or often go down apparently for no reason. To clean up the device, users must check their installed apps and remove something unknown or suspicious; Scan with Google Play Protect, monitor their network activity and eventually perform a factory reset if necessary.
Via Bleeping computer
