Google and Partners Disrupt BadBox-Style XCPE Botnet of 1.3 Million Infected Android Set-Top Boxes/IoT Devices
Baseado só no resumo do feed. O site da fonte não liberou o texto completo para o Tifon, então esta análise saiu apenas do resumo publicado no feed e pode estar incompleta. Ela é atualizada quando outra fonte cobrir o assunto. Ler na fonte original ↗
Google, along with industry partners, dismantled a large-scale botnet dubbed XCPE that had compromised approximately 1.3 million Android-based set-top boxes and IoT devices worldwide. Google alleges the operation was run by Android device manufacturer Videostrong, which allegedly pre-installed or delivered a backdoor on its devices, creating a persistent foothold used to build criminal infrastructure. The botnet appears similar in nature to prior Android-based set-top-box botnets (e.g., BadBox), leveraging compromised consumer IoT hardware to support ad fraud, proxy services, or other illicit operations. The disruption effort involved coordinated action by Google and unnamed partners to take down the command-and-control infrastructure and limit the botnet's reach.
Detalhes técnicos
The infected devices were primarily Android-based set-top boxes and other IoT devices, compromised via a backdoor reportedly built into the firmware or software supplied by Videostrong. This backdoor allowed attackers to enroll devices into a botnet used for broader criminal activity, though the article does not specify the exact monetization scheme (e.g., ad fraud, residential proxy, DDoS).
Remediação
The article does not provide specific remediation guidance for affected device owners, though general best practices include checking devices against known indicators of compromise, applying manufacturer firmware updates when available, and replacing devices confirmed to contain embedded backdoors.
Linha do tempo
-
darkreading.com ↗ · pub. 04/11/2026 13:24 · coletado 04/11 14:00 primeiro registro só resumo do feed
Google and Partners Disrupt BadBox-Style XCPE Botnet of 1.3 Million Infected Android Set-Top Boxes/IoT Devices
ler a análise desta fonte ocultar
Google, along with industry partners, dismantled a large-scale botnet dubbed XCPE that had compromised approximately 1.3 million Android-based set-top boxes and IoT devices worldwide. Google alleges the operation was run by Android device manufacturer Videostrong, which allegedly pre-installed or delivered a backdoor on its devices, creating a persistent foothold used to build criminal infrastructure. The botnet appears similar in nature to prior Android-based set-top-box botnets (e.g., BadBox), leveraging compromised consumer IoT hardware to support ad fraud, proxy services, or other illicit operations. The disruption effort involved coordinated action by Google and unnamed partners to take down the command-and-control infrastructure and limit the botnet's reach.
Technical Details
The infected devices were primarily Android-based set-top boxes and other IoT devices, compromised via a backdoor reportedly built into the firmware or software supplied by Videostrong. This backdoor allowed attackers to enroll devices into a botnet used for broader criminal activity, though the article does not specify the exact monetization scheme (e.g., ad fraud, residential proxy, DDoS).
Remediation
The article does not provide specific remediation guidance for affected device owners, though general best practices include checking devices against known indicators of compromise, applying manufacturer firmware updates when available, and replacing devices confirmed to contain embedded backdoors.