Google disrupts botnet infecting 1.3 million Android devices

Google says a botnet of more than 1.3 million Android devices, predominantly Android TV box models, was disrupted in late October by a takedown led by Google. The firm states videostrong, a Shenzhen-based maker of Android TV boxes, intentionally embedded a backdoor named x[.]cpe and sold access to criminals.

The backdoor reportedly runs inside the firmware as a system app with full device control, can disable Play Protect checks, and allows operators to install apps, run commands, capture screens, map networks, and open reverse shells. Google indicates the operation also targeted control domains of more than a dozen other malware families and that the botnet leveraged home broadband connections for ad fraud and proxy traffic.

Trend Micro’s Enterprise unit tallies 1,472,554 infected devices across 206 models between 3 June and 1 October, with Malaysia, Brazil, Iraq, Mexico and Taiwan seeing the largest shares, and the U.S., Germany, the U.K., Australia and Canada each reporting tens of thousands of affected boxes.

In its investigation, Google collaborated with law enforcement and security firms, including Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI. Google says it has banned Videostrong from building or selling certified Android devices and from supplying software to other certified makers. The backdoor reportedly persists in firmware and reinstall persists after reboot; cleanup is described as requiring vendor action, platform protection, or device replacement.

Plume recommends a full factory reset, while Synthient advises consumers to discard affected devices. For organisations, Synthient suggests using its indicators to locate MECOOL or similar devices on networks, disconnect or dispose of them, block the botnet’s control domains and IPs, and segment home devices from sensitive networks. TrendAI urges treating unmanaged consumer devices on remote networks as part of the corporate attack surface.