Google GTIG and partners disrupt XCPE Android botnet preinstalled by Videostrong on 1.3M+ set-top boxes
Google Threat Intelligence Group (GTIG) reported on November 2 that it assessed with high confidence that Chinese Android ODM/OEM Videostrong Technology was responsible for the XCPE botnet and backdoor. The botnet contained more than 1.3 million set-top boxes. Google, working with partners, disrupted the C2 servers used by Videostrong's criminal affiliates to install over a dozen malware families, severing control of more than 10 million compromised devices. Google has cut ties with Videostrong and banned it from making devices with preloaded Google apps. Besides set-top boxes, the botnet included telehealth devices, karaoke machines and digital signage. Google warns the underlying illicit market is resilient and that operators will pivot to new loaders or rival monetization SDKs.
Detalhes técnicos
- The backdoor x.cpe was embedded in device firmware for several years across many models and brands, and ran at
android.uid.systemprivilege level. - It reinstalls itself from the
/oem/partition on reboot if a user removes it. - On startup it contacts a C2 server and uses the MQTT message broker for commands. Affiliates can execute shell scripts, disable Google Play Protect and silently install additional apps.
- Videostrong monetized access by selling it to criminal affiliates, who loaded modules for ad fraud, enrolled devices in residential proxy networks and installed further malware.
- Proxy and monetization SDKs named include Linkfog, AppSalt/Honeygain, GaGaNode, NetNut and Traffmonetizer.
- Google says the campaign was not an isolated rogue insider or development oversight.
Remediação
The article gives no user-level remediation. Google's response was the C2 disruption and the ban on Videostrong preloading Google apps. Google calls for accountability across the hardware supply chain, the residential proxy industry and the wider technology ecosystem.
Linha do tempo
-
Google GTIG and partners disrupt XCPE Android botnet preinstalled by Videostrong on 1.3M+ set-top boxes
ler a análise desta fonte ocultar
Google Threat Intelligence Group (GTIG) reported on November 2 that it assessed with high confidence that Chinese Android ODM/OEM Videostrong Technology was responsible for the XCPE botnet and backdoor. The botnet contained more than 1.3 million set-top boxes. Google, working with partners, disrupted the C2 servers used by Videostrong's criminal affiliates to install over a dozen malware families, severing control of more than 10 million compromised devices. Google has cut ties with Videostrong and banned it from making devices with preloaded Google apps. Besides set-top boxes, the botnet included telehealth devices, karaoke machines and digital signage. Google warns the underlying illicit market is resilient and that operators will pivot to new loaders or rival monetization SDKs.
Technical Details
- The backdoor x.cpe was embedded in device firmware for several years across many models and brands, and ran at
android.uid.systemprivilege level. - It reinstalls itself from the
/oem/partition on reboot if a user removes it. - On startup it contacts a C2 server and uses the MQTT message broker for commands. Affiliates can execute shell scripts, disable Google Play Protect and silently install additional apps.
- Videostrong monetized access by selling it to criminal affiliates, who loaded modules for ad fraud, enrolled devices in residential proxy networks and installed further malware.
- Proxy and monetization SDKs named include Linkfog, AppSalt/Honeygain, GaGaNode, NetNut and Traffmonetizer.
- Google says the campaign was not an isolated rogue insider or development oversight.
Remediation
The article gives no user-level remediation. Google's response was the C2 disruption and the ban on Videostrong preloading Google apps. Google calls for accountability across the hardware supply chain, the residential proxy industry and the wider technology ecosystem.
- The backdoor x.cpe was embedded in device firmware for several years across many models and brands, and ran at