Google dismantles XCPE botnet of 1.3 million TV boxes

Google and industry partners have dismantled the XCPE botnet, a network of more than 1.3 million Android TV set-top boxes that its manufacturer, Videostrong Technology, had preloaded with malware. The backdoor was built into the device firmware during production, giving operators system-level control. Google's Threat Intelligence Group says it has high confidence that Videostrong intentionally installed the software to make money from cybercrime. The botnet ran ad-fraud software and turned infected boxes into residential proxies for other criminals.

How the malware worked

The malware, tracked as x.cpe and com.oemservice, contacts a command-and-control server on the anyevonline domain and uses an MQTT broker to receive commands. Operators could download and install more Android apps, disable Google Play Protect, capture screenshots, inject keystrokes and run shell commands with system privileges. The botnet also carried modules for ad fraud, residential proxy services such as Linkfog and NetNut, and other backdoors.

As part of the takedown, Google shut down the XCPE command servers and cut off access to at least 10 million more compromised devices, infected through other malware families. It banned Videostrong and any future subsidiaries and affiliates from building certified Android devices or supplying software to certified vendors. It also revoked the company's license to manufacture Android TV devices with preloaded Google apps, and changed its certification review process to close the testing gap the malware had used. The operation involved Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI.

Removal is hard. The main component can reinstall itself from a protected partition after a reboot, so deleting an app does not clear the device. Users would need to install clean firmware, or disconnect the device from the internet to stop the malicious activity.