Google helps dismantle XCPE botnet linked to more than 1.3 million Android TV boxes

Google says it helped dismantle the XCPE backdoor and a residential proxy network built with it. The company said more than 1.3 million set-top boxes alone were part of the network.

According to Google, the malware was preloaded on Android devices made by Videostrong, a certified Android original equipment manufacturer and design manufacturer. Google said Videostrong developed the malware, hid it from reviewers and sold criminals access to the botnet. The software was used for ad fraud, to install additional malware and to add devices to the proxy network.

Google said it worked with Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI to disrupt the operation. It took down domains and servers used to control the botnet and install malware modules, and C2 domains used by more than a dozen malware families delivered through XCPE.

Google also said it barred Videostrong and its future subsidiaries and affiliates from building or selling Android devices and from supplying software to other certified vendors. The company said it improved firmware integrity checks for certified Android TV devices. It attributed the incident to obfuscation that let malicious code load after a device’s first boot, exploiting a gap in its tests.

Google said it did not know how much Videostrong earned from the botnet or who used it. TechRadar noted that a separate case involving malware found on phones from multiple manufacturers last month differed because the supply chain had been compromised without the manufacturers’ knowledge or consent.