Google Disrupts XCPE Botnet Built Into 1.3 Million Set-Top Boxes by the Manufacturer

Google and industry partners have dismantled the XCPE backdoor, which enrolled more than 1.3 million set-top boxes into a botnet. Google says it assesses with high confidence that Videostrong Technology Co., an Android device manufacturer, intentionally developed, deployed and operated the backdoor for financial gain. It does not believe this was a rogue insider or an oversight.

According to Google, Videostrong sold access to criminal affiliates and loaded their malware modules onto infected devices. These modules carried out ad fraud, quietly enrolled devices into residential proxy networks, and installed further malware. Google also disrupted the command and control domains used by these affiliates. Because the affiliates distribute their modules through other channels too, Google assesses the action will cut off access to at least 10 million additional compromised devices. Users did not know about or consent to any of this activity, which also included data exfiltration and routing malicious traffic through the devices.

Google found the malicious software built into many device models and brands over several years. It says Videostrong used obfuscation to exploit a gap in its compatibility and security tests, loading malicious code after the device's first boot. Google has cut ties with Videostrong, banned it from making devices with preloaded Google apps, and changed its review process to guard against similar activity.