Vo1d rising: inside the botnet controlling 1.68 M+ Android TVs worldwide

Thursday 25 September 10:00 - 10:30, Red room

Alex Turing (QI-ANXIN)

The Vo1d botnet first came to light in September 2024. Far from fading, the botnet showcased impressive resilience through continuous technical evolution. About three months later, QAX XLab captured "jddx", a new downloader deployed by the evolved Vo1d. Leveraging this as an entry point, we conducted a thorough investigation, gathering 89 samples and mapping out extensive infrastructure: 1 Reporter, 4 Downloaders, 21 C2 domains, 258 DGA seeds, and over 100,000 DGA-generated domains.

We registered a subset of these DGA domains to study Vo1d's network scale and geographic distribution. Our data shows that the Vo1d botnet currently maintains around 800,000 daily active IPs, spanning more than 200 countries and regions worldwide.

Starting 14 January 2025, Vo1d's daily active IPs surpassed 1.5 million for an entire week. In February 2025, working with the Shadowserver Foundation, 12 Vo1d C2 servers were taken over. Updated metrics reveal an average of 1.2 million daily active IPs, with a notable peak of 1,685,459. Undoubtedly, the Vo1d botnet – with its vast scale of over a million devices and relentless technological advancements–represents a persistent and significant threat to global cybersecurity.

This talk will explore Vo1d's technical underpinnings, including its DGA implementation, ASR-variant XXTEA encryption, Bigpanzi-like string decryption and communication protocol. We'll also outline our analytical toolkits, hoping they aid the security community in studying the Vo1d botnet.

Back to VB2025 Programme page

Back to VB2025 conference page

Other VB2025 papers