Operators behind the Vo1d botnet have enhanced its capabilities, enabling rapid growth in recent months.
The Vo1d botnet infected nearly 1.3 million Android-based TV boxes in 197 countries, acting as a backdoor for downloading and installing third-party software.
The infections were most prevalent in Brazil, Morocco, Pakistan, Saudi Arabia, Russia, Argentina, Ecuador, Tunisia, Malaysia, Algeria, and Indonesia.
The Vo1d botnet has improved its stealth and resilience, utilizing RSA encryption, hardcoded and DGA-based Redirector C2s, and optimized payload delivery for harder detection.