# Google LLC v. Does 1-25

> District Court, S.D. New York · July 1, 2025

URL: https://www.frixlaw.com/law-library/cases/11088324

## Case

- **Court:** District Court, S.D. New York
- **Decided:** July 1, 2025
- **Opinion:** 100trialcourt
- **Cited by:** 0 later opinions in the Frix Law Library

## Citator (automated)

- No negative treatment found by the automated citator. That is not the same as a confirmation that the case is good law; read the citing cases.
- Full citator and citing cases: https://www.frixlaw.com/law-library/cases/11088324

## Opinion text

UNITED STATES DISTRICT COURT
FOR THE SOUTHERN DISTRICT OF NEW YORK
GOOGLE LLC,
Plaintiff, Civil Action No.: 1:25-cv-04503-JPO
v.

DOES 1–25,
Defendants.
PRELIMINARY INJUNCTION ORDER
Plaintiff Google LLC has filed a Complaint for injunctive and other relief to stop Doe
Defendants 1–25 (the “BadBox 2.0 Enterprise”) from continuing to control and operate a botnet

of over ten million devices (the “BadBox 2.0” botnet), continuing to distribute malware to infect
new devices, and continuing to carry out criminal schemes using that botnet.
Google filed a Complaint alleging claims under (1) the Computer Fraud and Abuse Act,
18 U.S.C. § 1030 (“CFAA”) (Count I) and (2) the Racketeer Influenced and Corrupt
Organizations Act, 18 U.S.C. § 1962(c)–(d) (“RICO”) (Count II). Google has moved under seal
and ex parte for a temporary restraining order and an order to show cause why a preliminary
injunction should not issue under Federal Rule of Civil Procedure 65 and 28 U.S.C. § 1651.
On May 30, 2025, this Court issued a Temporary Restraining Order (“TRO”) and order for
Defendants to show cause why a preliminary injunction should not issue. On June 6, 2025, this
Court extended that TRO until June 27, 2025.

THE COURT HEREBY FINDS THAT:
1. This Court has federal-question jurisdiction over Google’s claims under the CFAA
and RICO pursuant to 28 U.S.C. § 1331.
2. This Court has personal jurisdiction over Defendants because:
a. Defendants distribute malware within this district and New York State.
b. Defendants use that malware to infect user devices in this district.
c. Defendants use that fraudulently installed malware to sell access to the infected
user devices so that Defendants and others may use the IP addresses of the infected

devices to engage in fraudulent and criminal activity.
d. Defendants send commands to infected user computers in this district and within
New York State to carry out their illicit schemes.
e. Google’s Complaint and moving papers demonstrate that Defendants undertook
these activities intentionally with knowledge that their actions would cause harm to
users in New York and cause Google harm in New York. Google does business in
New York and has done business in New York for many years.
3. Venue is proper in this judicial district under 28 U.S.C. § 1391(c)(3) because
Defendants are not residents of the United States and may be sued in any judicial district. Venue

is also proper in this judicial district under 28 U.S.C. § 1391(b)(2) and 18 U.S.C. § 1965(a) because
a substantial part of the events or omissions giving rise to Google’s claims occurred in this judicial
district, because a substantial part of the property that is the subject of Google’s claims is situated
in this judicial district, because a substantial part of the harm caused by Defendants has occurred
in this judicial district, and because Defendants transact their affairs in this judicial district.
Moreover, Defendants are subject to personal jurisdiction in this district and no other venue
appears to be more appropriate.
4. The Complaint pleads facts with the specificity required by the Federal Rules of
Civil Procedure and states claims against Defendants for violations of the CFAA,
18 U.S.C. § 1030(a)(4), (a)(5)(A) (Count I) and RICO, 18 U.S.C. § 1962(c)–(d) (Count II).
Preliminary Injunction Order Factors
5. The Court finds that Google has established each of the factors required for a

preliminary injunction: (1) irreparable harm; (2) a likelihood of success on the merits and/or has
established a substantial question as to the merits; (3) the balance of hardships tips in Google’s
favor; and (4) a preliminary injunction serves the public interest. Benihana, Inc. v. Benihana of
Tokyo, LLC, 784 F.3d 887, 895 (2d Cir. 2015); see also Sterling v. Deutsche Bank Nat’l Tr. Co. as
Trustees for Femit Tr. 2006-FF6, 368 F. Supp. 3d 723, 727 (S.D.N.Y. 2019) (“The standard[s] for
granting a temporary restraining order and a preliminary injunction pursuant to Rule 65 of the
Federal Rules of [Civil] Procedure are identical.”).
Irreparable Harm
6. Google has established that it will suffer immediate, irreparable harm if this Court

denies its request for a preliminary injunction. Google has shown that Defendants—through their
participation in, and operation of, the BadBox 2.0 Enterprise—have threatened the security of the
internet, including Google platforms, by transmitting malware through the internet to configure,
deploy, and operate a botnet. Defendants have distributed malware on user devices that use the
Android Open Source Project (“AOSP”) operating system, which Google created and retains a
role in overseeing, that compromises the security of those devices, exploits those devices to carry
out a variety of advertising frauds, including through the Google Ad Network, and makes those
devices tools of various other cybercrimes by selling access to those devices to other threat actors
so that they may connect to an infected device’s IP address and use it to mask their location.
7. The Defendants control a botnet that has infected more than ten million devices. At
any moment, the botnet could be harnessed for additional criminal schemes. Defendants could, for
example, enable large ransomware or distributed denial-of-service attacks on legitimate businesses
and other targets. Defendants could themselves perpetrate such a harmful attack, or they could sell
access to the botnet to a third party for that purpose.

8. In addition, Defendants’ conduct is injuring Google’s goodwill and damaging its
reputation by falsely associating Google and the Android operating system with the fraud
perpetrated by the BadBox 2.0 botnet. Google has suffered and continues to suffer economic losses
from Defendants’ ad fraud on the Google Ad Network. In addition, Google has expended (and
continues to expend) substantial financial resources to investigate the BadBox 2.0 botnet and to
identify measures necessary to remediate the harms caused by the botnet. These injuries constitute
irreparable harm, including because Google has shown a likelihood that Defendants would not
comply with a judgment for money damages.
Likelihood of Success on the Merits

9. Google has shown not only that its Complaint presents a substantial question as to
each of its claims but that it is likely to succeed on the merits of its claims. See Sterling v. Deutsche
Bank Nat’l Tr. Co. as Trs. for Femit Tr. 2006-FF6, 368 F. Supp. 3d 723, 727 (S.D.N.Y. 2019).
10. CFAA. Google has shown a likelihood of success on the merits of its claim that
Defendants violated and continue to violate the CFAA. The CFAA prohibits, among other things,
knowingly causing the transmission of a program, information, code, or command to a protected
computer and as a result intentionally causing damage without authorization.
18 U.S.C. § 1030(a)(5)(A). And the CFAA prohibits accessing a protected computer without
authorization (or in excess of authorization) knowingly and with intent to defraud when such
access furthers the intended fraud and enables the perpetrator to obtain something of value. Id.
§ 1030(a)(4). Defendants violated both provisions, infecting over ten million devices worldwide
and tens of thousands of devices in the Southern District of New York alone. Defendants did so by
intentionally causing malware and commands to be transmitted to infected devices, which are used
in or affect interstate or foreign commerce or communication, without users’ knowledge or consent

and doing so to further Defendants’ fraudulent schemes, resulting in considerable value to
Defendants. Defendants’ actions have caused loss to Google in excess of $5,000 in a one-year
period.
11. RICO. Google has shown a likelihood of success on the merits of its claim that
Defendants have violated and continue to violate the RICO statute.
a. Google has shown that Defendants are active participants in the operation and
management of the BadBox 2.0 botnet, which is connected to
“command-and-control” servers (“C2 Servers”) associated with perpetrating
fraudulent ads and proxying activity on infected devices. The Infrastructure Group

established and manages the C2 infrastructure (C2 Servers and domains) for
BadBox 2.0. The Backdoor Malware Group developed and preinstalls malware on
the BadBox 2.0 devices and uses that malware to operate a botnet composed of a
subset of BadBox 2.0-infected devices and to carry out a variety of ad fraud
campaigns. The Evil Twin Group develops apps that the BadBox 2.0 Enterprise
uses to commit ad fraud via hidden ads. The Ad Games Group is connected to an
ad fraud campaign conducted through BadBox 2.0-infected devices that uses
fraudulent “games” to generate ads in hidden web browsers.
b. Google has established that Defendants constitute an enterprise. Defendants share
a common purpose to spread malware to build a botnet that is deployed for
numerous criminal schemes for profit. Defendants work together to accomplish this
purpose, each playing a role as described above, using a shared infrastructure, and
collaborating to fulfill their common purpose.

c. Google has established that Defendants have engaged in a pattern of racketeering
activity. See 18 U.S.C. § 1961(1), (5); id. § 2332b(g)(5)(B). The predicate acts
include violations of the CFAA, id. § 1030(a)(5)(A). Defendants have violated and
continue to violate the CFAA, id., resulting in damage as defined in
§ 1030(c)(4)(A)(i)(VI), by infecting protected computers with malware designed to
carry out their schemes. The predicate acts also include violations of the federal
wire fraud statute, 18 U.S.C. § 1343, which Defendants have violated and continue
to violate by transmitting signals in interstate or foreign commerce for the purpose
of executing their various fraudulent schemes.

d. Google has suffered injury to its business or property as a result of these predicate
offenses, including through Defendants’ ad fraud schemes and use of the botnet to
sell residential proxy access, by the refunds Google issues for fraudulent ad traffic,
and by devoting substantial financial resources to investigate and combat
Defendants’ criminal schemes in order to protect its goodwill and reputation.
Balance of Hardships
12. The equities also favor a preliminary injunction. The BadBox 2.0 Enterprise is
defrauding consumers and injuring Google, and the BadBox 2.0 botnet is growing in size and
capability. No countervailing factors weigh against a preliminary injunction. There is no legitimate
reason why Defendants should be permitted to continue to disseminate malware and manipulate
infected devices to carry out criminal schemes.
Public Interest
13. Google has shown that the public interest favors granting a preliminary injunction.
14. Every day that passes, Defendants infect new devices, engage in more fraud,

facilitate other threat actors’ cybercrimes by selling access to the IP addresses of infected devices,
and deceive more unsuspecting victims. Protection from malicious cyberattacks and other
cybercrimes is strongly in the public interest.
15. The public interest is clearly served by enforcing statutes designed to protect the
public, including the CFAA and RICO.
Good Cause for Alternative Service
16. The Court finds good cause exists to grant alternative service of the filings in this
matter via email using any information available from web-hosting companies provided in
connection with domain names used in the BadBox 2.0 botnet and/or any email addresses

identified through Google’s investigation; website publication; and/or other means because Google
establishes that traditional service methods would be futile. Given the online nature of Defendants’
conduct, online alternative service is most likely to give Defendants notice of the filings pertaining
to this lawsuit. Google will send notice by ordinary mail to the extent an address is available.
PRELIMINARY INJUNCTION ORDER
IT IS HEREBY ORDERED that Defendants, any of their officers, agents, servants,
employees, or attorneys, and all others in active concert or participation with them, who receive
actual notice of this Order by personal service or otherwise (“Restrained Parties”), are
preliminarily restrained and enjoined, from, anywhere in the world:
1. Intentionally accessing and sending malicious code to the protected computers of
Google’s customers without authorization;
2. Sending malicious code to configure, deploy, and operate a botnet;
3. Attacking and compromising the security of the devices and networks of Google’s
customers, including through modified versions of AOSP;

4. Stealing and exfiltrating information from computers and computer networks;
5. Configuring, deploying, operating, or otherwise participating in or facilitating the
botnet described in Google’s moving papers, including but not limited to (i) the C2 Servers
operating through the domains listed in Appendix A to the Complaint; (ii) the domains being
monetized by Defendants listed in Appendix A to the Complaint; and (iii) through any other
component or element of the botnet in any location;
6. Delivering malicious code designed to provide proxy access in order to take over
the device or engage in ad fraud;
7. Engaging in the sale of proxy services as described in the moving papers;

8. Engaging in ad fraud as described in the moving papers;
9. Using, linking to, transferring, selling, exercising control over, or otherwise owning
or accessing the domains attached in Appendix A; and/or
10. Undertaking any similar activity that inflicts harm on Google, Google’s customers,
or the public.
11. Upon service as provided for in this Order, Defendants and other Restrained Parties
shall be deemed to have actual notice of the issuance and terms of the Order, and any act by any
of the Restrained Parties in violation of any of the terms of the Order may be considered and
prosecuted as contempt of court.
12. In the event Google identifies additional domains or entities used in connection
with or participating in Defendants’ scheme, Google may move the Court for an order modifying
this Order as appropriate and may amend its Complaint to include the additional parties.
IT IS FURTHER ORDERED that Google may serve this Order on the persons or entities
hosting or providing services related to the domains identified in Appendix A, requesting that those

persons and entities take best efforts to implement the following actions:
1. Take reasonable steps to identify incoming and/or outgoing Internet traffic on their
respective networks that originates or is being sent from or to the domains identified in
Appendix A;
2. Take reasonable steps to block incoming and/or outgoing Internet traffic on their
respective networks that originates and/or is being sent from or to the domains identified in
Appendix A, by Defendants or Defendants’ representatives or resellers, except as explicitly
provided for in this Order;
3. Take other reasonable steps to block such traffic to and/or from any other

IP addresses or domains to which Defendants may move their botnet infrastructure, as identified
by Google in any supplemental request to this Order, to ensure that Defendants cannot use such
infrastructure to control the botnet or continue to perpetrate illegal acts;
4. Disable completely the computers, servers, electronic data storage devices,
software, data, or media assigned to or otherwise associated with the domains set forth in
Appendix A and make them inaccessible from any other computer on the Internet, any internal
network, or in any other manner, to Defendants, Defendants’ representatives, and all other persons,
except as otherwise ordered herein;
5. Completely, and until further order of this Court, suspend all services to Defendants
or Defendants’ representatives or resellers associated with the domains set forth in Appendix A;
6. Transfer any content and software hosted at the domains listed in Appendix A that
are not associated with Defendants, if any, to new domains not listed in Appendix A; notify any
non-party owners of such action and the new domains, and direct them to contact Google’s counsel

Laura Harris at King & Spalding LLP, 1185 Avenue of the Americas, 34th Floor, New York, New
York 10036-2601, and lharris@kslaw.com, to facilitate any follow-on action;
7. Refrain from providing any notice or warning to, or communicating in any way
with Defendants or Defendants’ representatives, and refrain from publicizing this Order until the
steps required by this Order are executed in full, except as necessary to communicate with hosting
companies, data centers, Google, or other ISPs to execute this Order;
8. Not enable, and take all reasonable steps to prevent, any circumvention of this
Order by Defendants or Defendants’ representatives associated with the domains listed in
Appendix A, including without limitation enabling, facilitating, and/or allowing Defendants or

Defendants’ representatives or resellers to rent, lease, purchase, or otherwise obtain other services
associated with those domains and IP addresses;
9. Preserve, retain, and produce to Google all documents and information sufficient
to identify and contact Defendants and Defendants’ representatives operating or controlling the
domains set forth in Appendix A, including any and all individual or entity names, mailing
addresses, e-mail addresses, facsimile numbers, telephone numbers, or similar contact
information, including but not limited to such contact information reflected in billing, usage,
access, and contact records and all records, documents, and logs associated with the use of or
access to such domains and IP addresses;
10. Provide reasonable assistance in implementing the terms of this Order and take no
action to frustrate the implementation of this Order; and
11. Completely preserve the computers, servers, electronic data storage devices,
software, data, or media assigned to or otherwise associated with the domains set forth in
Appendix A, and preserve all evidence of any kind related to the content, data, software or

accounts associated with such domains, IP addresses, and computer hardware.
12. In determining the method and mechanism to disable content and software
associated with Defendants, the relevant persons and/or entities shall reasonably confer with
Plaintiff’s counsel of record in this action.
IT IS FURTHER ORDERED that, pursuant to the All Writs Act, with respect to any
currently registered Internet domain set forth in Appendix A, the domain registries shall take or
cause to be taken the following actions:
1. Within three (3) business days of receipt of this Order, or as soon as practicable,
unlock and change the registrar of record for the domain or such other registrar specified by

Google. To the extent the registrar of record does not assist in changing the registrar of record for
the domain under its control, the domain registry for the domain, or its administrators, including
backend registry operators or administrators, within five (5) business days of receipt of this Order,
or as soon as reasonably practicable, shall change, or assist in changing, the registrar of record for
the domain or such other registrar specified by Google. The purpose of this paragraph is to ensure
that Google has control over the hosting and administration of the domain in the registrar account
specified by Google. Google shall provide to the domain registry or registrar of record any
requested registrar information or account details necessary to effectuate the foregoing.
2. The domains shall be made active and shall resolve in the manner set forth in this
order, or as otherwise specified by Google, upon taking control of the domains;
3. Take reasonable steps to work with Google to ensure the transfer of the domains
and to ensure that Defendants cannot use the domains to obtain unauthorized access to computers,
infect computers, compromise computers and computer networks, monitor the owners and users
of computers and computer networks, steal information from them, or engage in any other
activities prohibited by this Order;
4. The WHOIS registrant, administrative, billing, and technical contact and
identifying information should provide such information as may be specified by Google;
5. Prevent transfer, modification, or deletion of the domains by Defendants and
prevent transfer or control of the domain to the account of any party other than Google;
6. Take all steps required to propagate to the foregoing changes through the Domain
Name System (“DNS”), including domain registrars.
IT IS FURTHER ORDERED that Google may seek leave of Court to amend Appendix A
to the Complaint if it identifies other domains or IP addresses used by Defendants in connection
with the BadBox 2.0 Enterprise.
Security for Preliminary Injunction Order
IT IS FURTHER ORDERED that Google’s submission of the $75,000 bond to the Clerk
satisfied the requirements of this Court’s TRO. No additional bond is necessary.
So ordered.
June 27, 2025
New York, New York

United States District Judge

12

---

Source: Frix Law Library, https://www.frixlaw.com/law-library/cases/11088324. Public record. Not legal advice.