Google Disrupts XCPE Botnet Infecting 1.3 Million Android Devices

More than 1.3 million Android TV set‑top boxes were fitted with a backdoor that became a global botnet, Google said, and that botnet was used to run ad fraud, siphon data and turn household devices into residential proxies for criminal traffic.

Videostrong implanted a persistent backdoor and hid it after first boot

Google’s Threat Intelligence Group (GTIG) reported that Videostrong Technology Co., an approved Android device manufacturer, intentionally loaded malicious software into multiple device models it sold. According to Google researchers, Videostrong “slipped by Google’s security tests by loading the malicious code after the device’s first boot.” The report adds: “We found this malicious software built directly into many different device models and brands over multiple years, supported by dedicated infrastructure and constantly evolving configurations to evade detection and manage their affiliates.”

Charley Snyder, head of disruption operations at GTIG, summarized the adversary’s tradecraft: “The XCPE operators constantly evolved its configurations to evade Google’s pre and post-launch detections.” Snyder declined to say when or how Google first became aware of the approved vendor running the botnet.

XCPE’s scale, behaviors and device types

GTIG named the backdoored infrastructure XCPE. Most of the infected fleet consisted of Android TV set‑top boxes, but researchers also observed infected Android‑based telehealth devices, karaoke machines and digital signs. The compromised devices were “offered as a distribution mechanism for a wide array of criminal actors,” Google said, and were used for “ad‑fraud, data exfiltration, and routing malicious network traffic through the devices.”

The botnet stretched across more than 170 countries. TrendAI researchers identified the largest concentrations of infected devices in Malaysia, Brazil, Iraq, Mexico and Taiwan. Google reported nearly 44,000 infected devices in the United States between June and October.

Legal and technical disruption: domains, servers and banned vendor status

Google said it took legal action to seize and shut down domains and servers Videostrong used to control XCPE. The company also disrupted command‑and‑control domains that more than a dozen malware families had been running as modules through the XCPE backdoor, and said those takedowns “disrupted access to at least 10 million additional compromised devices from various manufacturers.”

As part of its response, Google banned Videostrong — and "any future subsidiaries" — from building or selling certified Android devices. The company told CyberScoop it changed its review process to detect and stop similar activities going forward, but GTIG is not publicly sharing technical specifics of those changes to avoid providing threat actors hints to evade future protections.

Collaborations and claimed impact on criminal operators

Google worked with multiple outside organizations to study and dismantle XCPE. Named partners include Japan’s National Police Agency, Lumen Technologies, Human Security, Plume and Synthient. GTIG said the dismantling “seriously impacted over a dozen malicious actors.”

Even with that disruption, Google warned that “the underlying market for backdoors, ad fraud and residential proxy networks are resilient and operating as an interconnected supply chain,” signaling that takedowns address symptoms inside a broader, continuing ecosystem.

What this means for technologists, procurement leaders, and end users

• Technologists and security teams: Expect adversaries to use post‑manufacture and post‑boot techniques to evade testing; GTIG’s description underscores that detection needs to include behavior after the first device startup as well as supply‑chain vetting.
• Procurement leaders at enterprises and service providers: The incident shows an approved vendor can ship devices with embedded backdoors and that vendor status alone is not a guarantee — Google’s ban on Videostrong highlights enforcement, but buyers will have to demand stronger attestation and testing.
• End users and operators of affected devices: Infected devices were used without users’ knowledge or consent; owners of Android TV boxes, telehealth devices, digital signs and similar appliances should treat unexpected traffic patterns and unexplained behavior as potential indicators of compromise.

Google’s public account documents a broad disruption: domains and servers removed, a banned manufacturer, and at least 10 million additional devices claimed to have been cut off from control servers. But GTIG also declined to say when it first detected the campaign and is withholding details of its tightened review process. That mix—decisive action paired with limited disclosure—leaves a narrow, concrete question: will the revised review procedures prevent other certified vendors from embedding similar backdoors after first boot, or will the market for post‑manufacture backdoors simply shift tactics?

Original story: https://cyberscoop.com/google-disrupts-xcpe-botnet-videostrong-android-devices/