Google files a lawsuit in the US against 25 unnamed individuals in China, accusing them of operating the BadBox 2.0 botnet, compromising 10M+ devices worldwide
Jessica Lyons / The Register :
Context & Ripple Effects
Google has used U.S. civil litigation against alleged botnet operators before, including a 2021 case over a botnet said to have infected more than 1 million devices. A subsequent default ruling against the accused operators shows the legal route can produce a judgment even when defendants do not participate.
This case extends that playbook to a much larger alleged device footprint and unnamed defendants in China, making attribution and identification central to whether the action produces practical disruption.
First-order effects
- Google is asking a U.S. court to pursue 25 unnamed individuals it alleges operated BadBox 2.0; the alleged operators face immediate legal exposure if identified and served.
- Owners of the more than 10 million allegedly compromised devices are the directly affected population, though the report does not establish that the filing itself remediates those devices.
Second-order effects
- The suit puts additional pressure on infrastructure, intermediaries, and accounts tied to the alleged botnet once they are identified, while giving Google a formal mechanism to seek information and court-ordered relief.
- It reinforces Google’s use of litigation alongside technical security operations; that approach later appeared in its action targeting an alleged Chinese residential-proxy network used by bad actors.
Third-order effects
- If large botnets increasingly span jurisdictions where direct criminal enforcement is difficult, civil cases may become a more regular tool for platform-led disruption, even when collecting judgments remains uncertain.
- The pattern shifts cyber defense toward a combined model of attribution, infrastructure action, and court process rather than relying on device cleanup or criminal prosecution alone.
The trend: Platform companies are increasingly treating civil litigation as an operational cyber-defense tool for disrupting cross-border abuse networks.