Pre-infected Android TV boxes: Google dismantles XCPE botnet with Australian victims

Google and its industry partners say they dismantled a botnet called XCPE in late October, after it had enrolled more than 1.3 million devices. The Google Threat Intelligence Group (GTIG) assessed with high confidence that Shenzhen-based Videostrong Technology built, deployed and operated a backdoor in its own Android TV box firmware for financial gain. Videostrong sold access to criminal affiliates, who loaded their own malware onto the boxes. Those add-on modules carried out advertising fraud, installed further malware and turned the devices into exit nodes for residential proxy services, which rent out household internet connections so buyers can hide their traffic.

Australian users were exposed. Plume Security Labs mapped infections from the botnet's command traffic and found clusters around Sydney, Melbourne, Brisbane, Perth and Adelaide. Synthient found the same malware in MECOOL-branded boxes sold by Skyworth Technology. The backdoor ran with system-level privileges, reinstalled itself if removed and switched off Google Play Protect's app verification. GTIG said operators could capture screenshots, inject keystrokes, steal account information and open reverse shells. The malware also turned up in telehealth devices, karaoke machines and digital signage.

Google has cut ties with Videostrong and barred it and any future affiliates from building certified Android devices. Partners also took down command servers for more than a dozen malware families, which GTIG estimates will cut off access to at least 10 million more compromised devices.