Vo1d Botnet Exposed: How Darktrace Detected a Global Android Threat

Vo1d malware first appeared in the wild in September 2024 and has since evolved into one of the most widespread Android botnets observed, primarily targeting smart TVs and low-cost Android TV boxes, with an estimated 1.3 to 1.6 million devices infected worldwide by early 2025. According to Darktrace, the surge in Vo1d-related activity was observed this year across customer environments, with a concentration in South Africa and unusual DNS lookups indicating DGA-based C2 communication.

The campaign employs Domain Generation Algorithms to create large lists of candidate domains and uses DGA seeds to ensure infected devices generate the same domains, with C2 infrastructure often hosted within major cloud environments and linked to the AMAZON-02 ASN (AS16509). Darktrace traced connections to the external IP 45.135.232[.]229 (AS198953 Proton66) used for data exfiltration over SSH, and noted ransom activity including a readme.txt ransom note and the DF_WIN file extension associated with encryption.

The investigation highlights a pattern of high-volume DNS requests, rare outbound ports such as 55520 and 55521, and a broader “established foothold” phase before encryption, with the post-incident analysis referencing DragonForce affiliations.