Google disrupts XCPE botnet infecting 1.3 million devices

Google and industry partners have disrupted the XCPE backdoor and botnet, which Google says had enrolled more than 1.3 million devices. Google Threat Intelligence Group assesses with high confidence that Android device manufacturer Videostrong Technology Co. intentionally developed and operated the system for financial gain, selling criminal affiliates access to infected devices and loading their malware. The affected hardware was mainly Android TV set-top boxes, but Google also found infections on telehealth devices, karaoke machines and digital signage.

The malware was built into device firmware and ran with system-level privileges. It could reinstall itself after removal, contact command servers over HTTP and MQTT, install apps without users’ knowledge, run shell commands, capture screens and exfiltrate device and account information. Affiliate modules turned devices into residential proxy nodes, carried out ad fraud or installed further backdoors.

Google says operators used obfuscation to load malicious code after first boot, exploiting a gap in its device testing. Its investigation found evidence of active use, including operators issuing commands and capturing live screenshots.

Google took legal action to disable Videostrong’s control servers and command-and-control domains used by more than a dozen malware families. It has cut ties with Videostrong, barred the company and its future affiliates from making certified Android devices or supplying software to certified vendors, and changed its firmware review process.

Google estimates that disrupting affiliate command servers could cut access to at least 10 million additional compromised devices, since those groups also used other distribution channels. The work involved Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI.