Google disrupts XCPE Android TV botnet of 1.3M devices and bans Videostrong Technology
Google disrupted XCPE, a backdoor embedded in the firmware of Android TV set-top boxes, and Google Threat Intelligence Group attributes the operation with high confidence to Videostrong Technology, the manufacturer of many of the boxes. More than 1.3 million devices were enrolled. The company sold access to criminal affiliates, who pushed their own modules for hidden ad fraud, residential proxy enrollment, theft of account details and logs, and further malware installation. Google estimates that taking down the affiliates' command domains cuts off at least 10 million more compromised devices that arrived through other routes and malware families. Google took legal action against the infrastructure and banned Videostrong and its future subsidiaries and affiliates from building certified Android devices.
Detalhes técnicos
- The main component runs with system privileges and reinstalls itself from a protected partition after reboot, so deleting the app does not clear the device.
- It disables Google Play Protect by rewriting the package verification setting and wipes records of user consent.
- Operators can take live screenshots, inject keystrokes and open a shell on the device.
- Since August 2026, operators have installed droppers disguised as system packages that use a privilege escalation exploit to write to the system partition, making removal harder.
- Besides set-top boxes, other infected Android-based IoT devices include telehealth devices, karaoke machines and digital signage.
- Affiliate modules were used for hidden ad views, residential proxy networks, credential and log theft, and delivery of more than a dozen malware families.
Remediação
- Google took legal action against the tasking and module delivery domains and servers, and against the command infrastructure of more than a dozen malware families.
- Google tightened firmware integrity checks for certified Android TV devices and changed its manufacturer review process to close the testing gap that was abused.
- Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI contributed to the takedown.
- Because deleting the app does not remove the implant, owners of affected boxes cannot rely on uninstalling it.
Linha do tempo
-
Google disrupts XCPE Android TV botnet of 1.3M devices and bans Videostrong Technology
ler a análise desta fonte ocultar
Google disrupted XCPE, a backdoor embedded in the firmware of Android TV set-top boxes, and Google Threat Intelligence Group attributes the operation with high confidence to Videostrong Technology, the manufacturer of many of the boxes. More than 1.3 million devices were enrolled. The company sold access to criminal affiliates, who pushed their own modules for hidden ad fraud, residential proxy enrollment, theft of account details and logs, and further malware installation. Google estimates that taking down the affiliates' command domains cuts off at least 10 million more compromised devices that arrived through other routes and malware families. Google took legal action against the infrastructure and banned Videostrong and its future subsidiaries and affiliates from building certified Android devices.
Technical Details
- The main component runs with system privileges and reinstalls itself from a protected partition after reboot, so deleting the app does not clear the device.
- It disables Google Play Protect by rewriting the package verification setting and wipes records of user consent.
- Operators can take live screenshots, inject keystrokes and open a shell on the device.
- Since August 2026, operators have installed droppers disguised as system packages that use a privilege escalation exploit to write to the system partition, making removal harder.
- Besides set-top boxes, other infected Android-based IoT devices include telehealth devices, karaoke machines and digital signage.
- Affiliate modules were used for hidden ad views, residential proxy networks, credential and log theft, and delivery of more than a dozen malware families.
Remediation
- Google took legal action against the tasking and module delivery domains and servers, and against the command infrastructure of more than a dozen malware families.
- Google tightened firmware integrity checks for certified Android TV devices and changed its manufacturer review process to close the testing gap that was abused.
- Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI contributed to the takedown.
- Because deleting the app does not remove the implant, owners of affected boxes cannot rely on uninstalling it.