Google dismantles botnet of 1.3M Android TV boxes with built-in malware

Google, in cooperation with cybersecurity partners, has dismantled the infrastructure of the XCPE botnet, which comprised over 1.3 million television set-top boxes and other Android-based devices. According to the Google Threat Intelligence unit, the malicious software had been pre-installed into the equipment firmware by the Chinese company Videostrong Technology for years. The manufacturer not only distributed compromised devices but also provided paid access to them and allowed the upload of custom malicious modules.

• Google dismantled the XCPE botnet consisting of 1.3 million infected Android TV boxes.
• Malware was embedded directly into device firmware by Videostrong Technology for years.
• Infected hardware was used for ad fraud, proxy networks, and spreading further malware.
• Google severed ties with the manufacturer and updated its firmware review procedures.

How the XCPE Firmware Backdoor Worked The infected set-top boxes were utilized for ad fraud, setting up resident proxy networks, and distributing additional malware. A resident proxy turns an ordinary user's device into an intermediate node for external internet traffic, allowing malicious actors to route requests that appear to external services as originating from the device owner's home IP address. Certain modules also enabled remote command execution, silent app installation without user consent, screen capture, and data extraction. The XCPE backdoor was embedded directly into the system partition of the firmware, granting it Android system-level privileges. If a user attempted to delete it from standard app menus, the malware could restore itself after a reboot. Communication with operators relied on the MQTT protocol, enabling covert remote management of the devices even after sale to end consumers.

Google's Response and Investigation Details Google announced it has severed all business relations with Videostrong, prohibiting the company and its future subsidiaries from releasing certified Android devices with Google apps or supplying software to other certified vendors. The tech giant also successfully disabled domains and servers utilized for managing XCPE and associated rogue modules. Google estimates this action will cut off operators from at least another 10 million compromised devices distributed by other criminal network participants. The investigation involved the Japan National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and TrendAI. The hardware manufacturer bypassed Google security checks using obfuscation methods, downloading the malicious payload only after the device's initial user setup.

Future Outlook and Recommendations for Users Google warns that shutting down command servers does not completely eliminate the threat, as botnet and proxy network operators function as an interconnected ecosystem and can easily migrate to alternative loaders and software modules. The company advises consumers to purchase internet-connected smart devices strictly from trusted manufacturers and avoid third-party applications promising rewards for sharing unused internet bandwidth.