Google disrupts XCPE botnet that infected 1.3 million devices

Google and industry partners have disrupted the XCPE botnet, which Google’s Threat Intelligence Group (GTIG) attributes with high confidence to Videostrong Technology Co. The operation infected more than 1.3 million Android-based devices—primarily Android TV set-top boxes—and embedded a backdoor that allowed criminal affiliates to access compromised hardware and deploy their own malware modules.

Google notes that these modules were used for ad-fraud, enrolling devices into residential proxy networks, and loading further malware onto XCPE-compromised devices.

The disruption involved takedowns of the botnet’s domains and servers, and the severing of the command-and-control infrastructure that enabled affiliates to operate their modules. Google, together with partners including Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI, also cut ties with Videostrong and banned the manufacturer from making or supplying Android devices or software to certified vendors.

Beyond set-top boxes, Google identified IoT devices affected by the campaign, such as telehealth equipment, karaoke machines and digital signage. The firm stressed that the vast majority of infections were consumer devices, though the implications extend to enterprise and healthcare environments where such devices, if connected to inappropriately segmented networks, could provide attackers with a foothold.

Google described Videostrong’s evasion of initial security checks via obfuscation techniques and pledged to strengthen Android TV firmware review processes going forward.